chrome-cdp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited chrome-cdp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Lightweight Chrome DevTools Protocol CLI. Connects directly via WebSocket — no Puppeteer, works with 100+ tabs, instant connection.
chrome://inspect/#remote-debugging and toggle the switchDevToolsActivePort is in a non-standard location, set CDP_PORT_FILE to its full pathAll commands use scripts/cdp.mjs. The <target> is a unique targetId prefix from list; copy the full prefix shown in the list output (for example 6BE827FA). The CLI rejects ambiguous prefixes.
scripts/cdp.mjs listscripts/cdp.mjs shot <target> [file] # default: screenshot-<target>.png in runtime dirCaptures the viewport only. Scroll first with eval if you need content below the fold. Output includes the page's DPR and coordinate conversion hint (see Coordinates below).
scripts/cdp.mjs snap <target>scripts/cdp.mjs eval <target> <expr>Watch out: avoid index-based selection (querySelectorAll(...)[i]) across multipleevalcalls when the DOM can change between them (e.g. after clicking Ignore, card indices shift). Collect all data in oneevalor use stable selectors.
scripts/cdp.mjs html <target> [selector] # full page or element HTML
scripts/cdp.mjs nav <target> <url> # navigate and wait for load
scripts/cdp.mjs net <target> # resource timing entries
scripts/cdp.mjs click <target> <selector> # click element by CSS selector
scripts/cdp.mjs clickxy <target> <x> <y> # click at CSS pixel coords
scripts/cdp.mjs type <target> <text> # Input.insertText at current focus; works in cross-origin iframes unlike eval
scripts/cdp.mjs loadall <target> <selector> [ms] # click "load more" until gone (default 1500ms between clicks)
scripts/cdp.mjs evalraw <target> <method> [json] # raw CDP command passthrough
scripts/cdp.mjs open [url] # open new tab (each triggers Allow prompt)
scripts/cdp.mjs stop [target] # stop daemon(s)shot saves an image at native resolution: image pixels = CSS pixels × DPR. CDP Input events (clickxy etc.) take CSS pixels.
CSS px = screenshot image px / DPRshot prints the DPR for the current page. Typical Retina (DPR=2): divide screenshot coords by 2.
snap --compact over html for page structure.type (not eval) to enter text in cross-origin iframes — click/clickxy to focus first, then type.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.