Skills chrome-devtools-debugging

📦

chrome-devtools-debugging

Name: chrome-devtools-debugging
Author: Consiliency

Content revision r1 High Risk 🌐 Network access⚡ Contains scripts⚙️ External commands

Debug Web Applications with Chrome DevTools

Browser failures are difficult to diagnose when console, network, and performance evidence is scattered. This skill guides focused Chrome DevTools MCP investigations.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "chrome-devtools-debugging" from https://skillstore.io/skills/consiliency-chrome-devtools-debugging.md and its manifest at https://skillstore.io/api/skills/consiliency-chrome-devtools-debugging/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/consiliency-chrome-devtools-debugging.md Signed manifest GET /api/skills/consiliency-chrome-devtools-debugging/manifest Signed lockfile GET /api/skills/consiliency-chrome-devtools-debugging/lockfile

Test it

Using "chrome-devtools-debugging". Find why checkout fails after the user submits payment.

Expected outcome:

Primary failure: the payment request returns status 400 after 842 milliseconds.
Console correlation: the submission handler reports a missing billing postal code.
Next check: verify the client payload mapping for the postal code field.

Using "chrome-devtools-debugging". Explain why the dashboard loads slowly.

Expected outcome:

Largest delay: the analytics request blocks completion for 2.4 seconds.
Render impact: two scripts load before the main content becomes interactive.
Priority: defer analytics and review the larger script dependency.

Using "chrome-devtools-debugging". Check why a test account loses its session after refresh.

Expected outcome:

The refresh request returns unauthorized while the expected session indicator is absent. Credential values were redacted from the report.

Security Audit

High Risk

v10 • 7/13/2026 Open versioned report

Most static findings are false positives caused by Markdown formatting, reserved example URLs, localhost endpoints, and a normal Python import. The guides expose authenticated browser data, enable remote debugging on logged-in sessions, and recommend an unpinned NPM package. Publication should require version pinning and clear browser isolation and secret-handling safeguards.

Files scanned

1,033

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:110-130 cookbook/console-debugging.md:91-108 cookbook/network-debugging.md:90-130 reference.md:183-206

Authentication Secrets Printed in Debug Output

The guides direct users to print complete localStorage, sessionStorage, cookies, token values, and inspect authorization headers from authenticated sessions. This can expose credentials in terminal logs or model context.

Multiple explicit examples read and print browser authentication storage, cookies, tokens, or authorization data without redaction guidance.

Medium

SKILL.md:29-46 SKILL.md:110-130

Authenticated Browser Exposed to Remote Debugging

The setup enables a DevTools endpoint and then operates on a logged-in browser session. Any process that can reach the endpoint can control tabs and inspect sensitive page data.

The documented workflow explicitly starts Chrome with remote debugging and uses the connection against an authenticated session.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:172-179

Ruby/shell backtick execution

- MCP server not installed (`npx chrome-devtools-mcp@latest`)

The troubleshooting guidance recommends npx chrome-devtools-mcp@latest, which can download and execute a mutable package version without integrity pinning.

Risk Factors

🌐 Network access (16)

cookbook/console-debugging.md:200 cookbook/network-debugging.md:60 cookbook/network-debugging.md:149 cookbook/network-debugging.md:227 reference.md:102 reference.md:314 reference.md:80 reference.md:20 reference.md:222 reference.md:235 reference.md:275 reference.md:20 SKILL.md:144 SKILL.md:46 SKILL.md:180 SKILL.md:46

⚡ Contains scripts (1)

reference.md:110-114

⚙️ External commands (38)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/consiliency-chrome-devtools-debugging/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/consiliency-chrome-devtools-debugging/security.svg)](https://skillstore.io/skills/consiliency-chrome-devtools-debugging?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/consiliency-chrome-devtools-debugging?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/consiliency-chrome-devtools-debugging/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/consiliency-chrome-devtools-debugging.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Consiliency. (2026). chrome-devtools-debugging security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/consiliency-chrome-devtools-debugging/audits/10

BibTeX citation

@techreport{consiliency-consiliency-chrome-devtools-debugging-2026,
  author = {Consiliency},
  title = {chrome-devtools-debugging security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/consiliency-chrome-devtools-debugging/audits/10},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "chrome-devtools-debugging security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
  - name: "Consiliency"
date-released: "2026-07-13"
url: "https://skillstore.io/skills/consiliency-chrome-devtools-debugging/audits/10"
identifiers:
  - type: other
    value: "skillstore:consiliency-chrome-devtools-debugging:audit:10"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Resolve Frontend Runtime Failures

Correlate console exceptions, stack traces, and application state to identify the first actionable browser error.

Validate Login and API Flows

Inspect failed requests, status codes, timing, and redacted authentication signals during a controlled test session.

Investigate Slow Page Loads

Capture a performance trace and compare slow requests, blocking resources, and available DevTools insights.

Try These Prompts

Inspect Console Errors

Connect to the current Chrome tab. List errors and warnings from the latest page load. Group duplicates and explain the likely first cause.

Diagnose a Failed API Request

Find failed XHR and fetch requests for [workflow]. Inspect the relevant status, timing, and redacted response details. Correlate them with console errors.

Analyze Page Performance

Record a fresh page-load trace for [page]. Identify slow requests and blocking resources. Rank the three highest-impact findings with supporting evidence.

Correlate an Authenticated Failure

Investigate the authenticated failure on [page]. Use a dedicated test profile. Correlate console errors, failed requests, timing, and page state. Redact credentials and personal data. Explain the root-cause hypothesis and remaining evidence gaps.

Best Practices

Use a dedicated temporary Chrome profile and test account for authenticated debugging.
Start with narrow filters, then correlate console, network, and performance evidence by time and request.
Redact cookies, tokens, authorization headers, personal data, and sensitive response bodies before reporting results.

Avoid

Do not print complete browser storage, cookies, headers, or response bodies from real user sessions.
Do not expose the remote debugging endpoint beyond loopback or leave it running after the investigation.
Do not evaluate unreviewed scripts or execute mutable package versions in a trusted environment.