Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hypnguyen1209/offensive-claude --skill browser-exploitationgit clone --depth 1 https://github.com/hypnguyen1209/offensive-claudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hypnguyen1209/offensive-claude/browser-exploitation)<a href="https://agentmods.dev/skills/hypnguyen1209/offensive-claude/browser-exploitation"><img src="https://agentmods.dev/badge/skills/hypnguyen1209/offensive-claude/browser-exploitation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hypnguyen1209/offensive-claude/browser-exploitation"><img src="https://agentmods.dev/badge/skills/hypnguyen1209/offensive-claude/browser-exploitation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.02708 |
| Opus 5 | $0.00030 | $0.01354 |
| Sonnet 5 | $0.00012 | $0.00542 |
| Haiku 4.5 | $0.00006 | $0.00271 |
Grade A, and why
browser-exploitation scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
| Electron IPC/preload RCE | `app.asar` mtime change, `node` child of Electron app, `child_process.exec` | Sigma: Electron app spawning shells; FIM on `app.asar`/snapshot blobs | Prefer in-process JS exec (require gadget How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Browser & Client-Side Exploitation
Turn a single client-side bug into full host compromise. The modern browser is a chain target: a JS-engine bug yields an in-renderer arbitrary read/write, the V8 heap sandbox must be escaped to get a native R/W, then a second logic/memory bug in a privileged process (browser broker, GPU) escapes the OS sandbox. Electron and embedded webviews collapse several of these steps. Every cluster pairs the offensive primitive with renderer-crash/IPC telemetry, Sigma/EDR detection, and cleanup OPSEC.
When to Activate
- A V8/JavaScriptCore bug (type confusion, OOB, UAF, JIT mis-speculation) must become
addrof/fakeobjand an in-renderer arbitrary R/W. - An in-renderer R/W exists but is trapped inside the V8 heap sandbox (pointer compression) and needs a trusted-pointer / Wasm-object escape to native memory.
- A renderer is fully compromised and you need to escape the OS sandbox via Mojo IPC handle/logic bugs or the GPU process (Dawn/WebGPU, ANGLE).
- Auditing or exploiting an Electron / CEF / WebView2 app:
contextIsolation/nodeIntegration/sandboxmisconfig, preload-bridge & IPC abuse, ASAR/fuse/snapshot tampering. - Assembling a 1-click drive-by RCE chain (renderer → sandbox escape → host) for an authorized red-team delivery, or doing cross-engine (Safari/JSC) work.
- Patch-diffing a Chrome/V8/WebKit security release to build an n-day client-side exploit.
Technique Map
| Technique | ATT&CK | CWE | Reference | Script |
|---|---|---|---|---|
| JIT type confusion (TurboFan/Maglev/Turboshaft) | T1203 | CWE-843 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js |
| Element-kind confusion -> addrof/fakeobj | T1203 | CWE-843 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js |
| OOB read/write on JSArray/TypedArray | T1203 | CWE-787 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js |
| In-renderer arbitrary R/W (fake TypedArray) | T1203 | CWE-787 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js |
| V8 heap-sandbox escape via raw Wasm pointer | T1203 | CWE-787 | references/v8-sandbox-escape.md | scripts/sandbox_escape.js |
| Trusted Pointer Table / WasmExportedFunctionData abuse | T1203 | CWE-843 | references/v8-sandbox-escape.md | scripts/sandbox_escape.js |
| Code/exec via Wasm JIT region pivot | T1203 | CWE-94 | references/v8-sandbox-escape.md | scripts/sandbox_escape.js |
| Mojo IPC handle-confusion sandbox escape | T1203 | CWE-269 | references/renderer-to-browser-escape.md | scripts/mojo_fuzz_harness.py |
| GPU-process UAF/OOB (Dawn/WebGPU, ANGLE) | T1203 | CWE-416 | references/renderer-to-browser-escape.md | scripts/mojo_fuzz_harness.py |
| Mojo interface fuzzing for broker bugs | T1203 | CWE-20 | references/renderer-to-browser-escape.md | scripts/mojo_fuzz_harness.py |
| Electron contextIsolation/IPC bridge RCE | T1059.007 | CWE-1188 | references/electron-webview-rce.md | scripts/electron_audit.py |
| nodeIntegration / webviewTag preload abuse | T1059.007 | CWE-829 | references/electron-webview-rce.md | scripts/electron_audit.py |
| ASAR integrity / fuse / V8 snapshot tamper | T1574.002 | CWE-345 | references/electron-webview-rce.md | scripts/electron_audit.py |
| XSS/open-redirect -> Electron RCE | T1189 | CWE-79 | references/electron-webview-rce.md | scripts/electron_audit.py |
| 1-click drive-by chain delivery | T1189 | CWE-693 | references/clientside-rce-chains.md | scripts/chain_server.py |
| Cross-engine (JSC/WebKit) primitive port | T1203 | CWE-843 | references/clientside-rce-chains.md | scripts/chain_server.py |
What ships with it
11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/clientside-rce-chains.md 8.6 KB
- references/electron-webview-rce.md 10 KB
- references/renderer-to-browser-escape.md 9.8 KB
- references/v8-jit-typeconfusion.md 9.3 KB
- references/v8-sandbox-escape.md 9.5 KB
- scripts/chain_server.py 7.7 KB runs code
- scripts/d8_debug.sh 2.8 KB runs code
- scripts/electron_audit.py 11 KB runs code
- scripts/mojo_fuzz_harness.py 10 KB runs code
- scripts/sandbox_escape.js 6.2 KB runs code
- scripts/v8_typer.js 6.3 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 112 lines · 61 tokens per session scan A 11ab5553711f
browser-exploitation is a skill published in the GitHub repository hypnguyen1209/offensive-claude (357 stars, last pushed 23d ago), licensed MIT. It adds 61 tokens to every session and 2,708 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
webcrawler-deep-crawl
Deep-crawl any website from start URLs, return per-page LLM-ready text/markdown/HTML plus metadata (title, description, author, language, canonical URL, OG) and in-scope outbound links. Use when user mentions deep crawl website, recursive crawl, crawl a whole site, scrape entire website, scrape docs site, scrape…
amazon-search-listing
Amazon search and category listing scraper: extract product listings from any Amazon search results page, keyword search URL, or category browse page and return per-item cards (asin, title, url, image, price, listPrice, stars, reviewCount, badges, isAmazonChoice, isBestSeller, isSponsored, delivery, boughtInPast…
ebay-search-listing
Extracts product listings from any eBay search or category page URL, returning per-item cards (itemNumber, url, title, subtitle, caption, price, priceWithCurrency, currency, wasPrice, bids, shipping, seller, sellerFeedbackCount, sellerPositiveRating, reviewsCount, starRating, image) plus pagination state (currentPage…
facebook-groups-scrape-posts
Scrapes posts from a Facebook group given a group URL, sort order, and desired count — returns structured post metadata including postid, permalink, author, timestamp, body text, images/videos, reaction counts, reaction type breakdown, comment count, and share count. Use when: user wants to scrape/extract Facebook…
facebook-page-profile-posts
Scrapes posts from any public Facebook Page or personal Profile timeline, returning structured data including post text, author info with profile picture, engagement metrics (likes/comments/shares), full reaction breakdown (Like/Love/Wow/Haha/Sad/Angry/Care as both array and flat counts), hashtags and external links…
amazon-bestseller-listing
Amazon Best Sellers listing scraper: extract product cards from any Amazon Best Sellers (zgbs) or /gp/bestsellers/ category page — returns rank (position on chart), asin, title, url, image, imageAlt, price, stars, reviewCount, ratingRaw per item, plus category metadata (categoryName, categoryFullName, categoryUrl) and…