Browser Agent - Chrome CDP 自动化

This skill appears to do what it claims (control Chrome via CDP) but it operates with sensitive privileges: it can read and act using your browser's logged‑in sessions and it suggests using --remote-allow-origins=* (which weakens WebSocket origin checks). Before installing or running: - Only run it on a machine you trust and preferably in an isolated profile/VM/container. Use a dedicated Chrome user-data-dir (not your main profile) to avoid exposing personal cookies/tokens. - Avoid enabling --remote-allow-origins=* on machines exposed to other networks; prefer binding CDP to localhost and firewalling the port. Follow the SKILL.md warning to not expose the CDP port to the internet. - Review any custom automation scripts you pass via --script; they can execute arbitrary CDP/JS against pages and could exfiltrate data. - Install Python deps in a virtualenv and inspect the two Python scripts (they are included) before running. The package.json vs Python packaging mismatch is harmless but indicates the author bundled files manually—verify origin and author trust. - If you want stricter guarantees, run the skill in a disposable environment, or decline installing if you cannot isolate browser profile access. If you want, I can extract and summarize the exact code paths that access page content, cookies, or network responses so you can audit them more precisely.