Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add PaulRBerg/agent-skills --skill chromium-browsergit clone --depth 1 https://github.com/PaulRBerg/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/paulrberg/agent-skills/chromium-browser)<a href="https://agentmods.dev/skills/paulrberg/agent-skills/chromium-browser"><img src="https://agentmods.dev/badge/skills/paulrberg/agent-skills/chromium-browser/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/paulrberg/agent-skills/chromium-browser"><img src="https://agentmods.dev/badge/skills/paulrberg/agent-skills/chromium-browser.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 20 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.04249 |
| Opus 5.5 | $0.00019 | $0.01700 |
| Sonnet 5.5 | $0.00009 | $0.00850 |
| Haiku 4.5 | $0.00005 | $0.00425 |
Grade C, and why
chromium-browser scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variableshighData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
extract credentials from page fields, extension storage, network traffic, or processes. Avoid captures of filled secret How it starts
The opening of the file, as written. The whole thing — 253 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Chromium Browser
Operate the configured Chrome DevTools MCP against the existing shared browser without disrupting unrelated tabs or authenticated state.
Prefer this skill for rendered web pages in shared Chromium. When they fit, use search, fetch, APIs, CLIs, or connectors
for retrieval. Use host computer-use/CUA tools for native apps, browser chrome, and browser-internal pages such as
chrome://extensions. Also use native controls for a user-requested browser without a usable browser integration.
Existing task authorization covers this controller choice without a separate permission request.
Use one controller at a time for each browser. Preserve existing profiles, sessions, and unrelated tabs across controllers. Native controls do not relax privacy rules or approval requirements for the action itself. If the user selects another available browser integration, follow its tool contract.
Environment Contract
- Treat the bundled
scripts/chrome-devtools-mcp.shwrapper and the tools exposed in the current session as authoritative. The wrapper runs the globally installedchrome-devtools-mcpexecutable and sets flags, logging, and browser attachment. Do not run the MCP package directly. - The MCP attaches to an existing remote-debugging browser and does not launch one.
- If an MCP call cannot attach to the browser, run the bundled
scripts/ensure-chromium.shonce. The helper launches Chromium with the shared profile on the configured port. It does nothing when the endpoint already responds. After it succeeds, retry the failed call once. If the call still fails, follow Troubleshooting. - Never launch Chromium another way, launch a fallback browser, or create another profile.
- Treat the browser as shared, authenticated, and concurrently used by the user and other agents. Inspect only pages relevant to the task and do not surface unrelated tab titles or content.
- Trust the live tool inventory. An absent tool is unavailable in this session. Do not advise editing client MCP configuration as a troubleshooting shortcut.
- The wrapper returns plain-text responses and permits file tools on every absolute path. Path capability is not write authorization.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +38 lines scan A → C 160f2b176571
- 5d ago Changed · +3 lines 460d02ec9d12
- 9d ago Changed · +11 lines aabfc8728ab9
- 13d ago Changed · +13 lines 1792bb69c092
- 17d ago Changed · +5 lines 9273861eb1b6
- 20d ago Changed · +3 lines 38d82ab5062c
- 27d ago Changed d4dcfdce39f0
- 28d ago Changed 4c2122facf60
- 1mo ago Changed · +1 lines dbbb4e78d7c7
- 1mo ago First seen · 179 lines · 47 tokens per session scan A 85e64ee2b9a1
chromium-browser is a skill published in the GitHub repository PaulRBerg/agent-skills (104 stars, last pushed 2d ago), licensed MIT. It adds 47 tokens to every session and 4,249 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it C with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
chromium-browser compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| chromium-browserPaulRBerg/agent-skills | Skill | 104 | 2d ago | MIT | C | 47 | Codex |
| chrome-devtools-cliChromeDevTools/chrome-devtools-mcp | Skill | 55k | yesterday | Apache-2.0 | A | 31 | Claude Code |
| opencli-autofixjackwener/OpenCLI | Skill | 31k | yesterday | Apache-2.0 | A | 61 | Claude Code |
| chrome-performance-optimizerchromium/chromium | Skill | 25k | today | BSD-3-Clause | A | 119 | Claude Code, Codex |
| nullawaychromium/chromium | Skill | 25k | today | BSD-3-Clause | A | 43 | Claude Code, Codex |
| reenable-testchromium/chromium | Skill | 25k | today | BSD-3-Clause | A | 85 | Claude Code, Codex |
| remove-circular-includeschromium/chromium | Skill | 25k | today | BSD-3-Clause | A | 37 | Claude Code, Codex |