Run the pre-flight checklist before an agent drives a browser — the untrusted-web-content threat (every page is attacker-controllable), the credential and session-cookie exposure, the action-confirmation gates for purchases and posts, and the sandboxing that limits the damage. Use when asked let my agent browse safely, is it safe to give the agent computer/browser use, guardrails before the agent uses my browser, or review my browser agent's setup. Produces the sandbox decision, the content-injection defenses, the action gates, and the credential-isolation rules.
▸The task — research/read-only (much safer), or does it need to *act* (buy, book, post, fill forms)? The gates exist for the acting kind
▸Whose browser — a fresh isolated profile, or your daily browser with all your logins live (the latter is the configuration that turns a prompt injection into a bank transfer)
▸The sensitivity of what's reachable — if the profile is logged into email, banking, or work systems, the blast radius is those systems
▸The autonomy level — supervised (you watch) or headless/background (it runs alone — which demands stricter gates because no human catches the hijack live)
✅ The bar it holds itself to
Every skill in this library self-verifies — these are this skill's own quality checks, straight from its definition.
✓The agent drives an isolated profile, not the user's logged-in-everywhere browser
✓Page content is framed as untrusted, with goal-drift detection
✓Every irreversible action has a details-showing confirmation gate
✓Credentials reachable by the profile are minimized to the task
✓Headless runs carry stricter gates and a kill-switch
⚠️ What it refuses to do
Do not point the agent at your daily browser — one injection reaches every account you're logged into
Do not treat web content as instructions — it's attacker-authorable data, always
Do not let buy/post/transfer flow without a gate — the gate is where a hijack gets caught
Do not stock the agent's profile with unrelated logins — need-to-reach, or it's blast radius
Do not run headless with supervised-grade gates — no human is watching, so the machine must be stricter
Install
npx pm-claude-skills add --agent claude # or codex · cursor · gemini · hermes
# or one-line MCP (every skill, any client):
claude mcp add pm-skills -- npx -y pm-claude-skills-mcp