browser-debug-setup

Refutation fails: the skill body openly instructs the agent to run rsync over the signed-in 'Profile 1' directory and cp Local State into ~/.config/google-chrome-debug-profile, duplicating credential-bearing browser data outside its original store; neither the declared description nor claims D3-D5 (all limited to debug-browser launch/connectivity on 9222) declares profile cloning or Local State reads, and no harm carve-out or mitigation covers duplicating a signed-in profile.

Refutation fails: the Rules section contains a concrete imperative to clone a signed-in Chrome profile (with its cookies/session auth) into the dedicated debug --user-data-dir; the declared description and claims D3-D5 cover only persistent debug-browser setup and dev-browser connectivity, so this credential-duplicating instruction is undeclared and fits no carve-out, even though the rule confines the source to a non-Default profile.

Refutation fails: the quoted heredoc reads Local State to enumerate profiles with Google account names, and the same block rsyncs 'Profile 1' plus Local State into the debug profile and launches CDP Chrome with the user's signed-in identity ('That keeps the signed-in identity while still satisfying Chrome's dedicated --user-data-dir requirement.'); the declared description and D3-D5 declare only debug-browser launch/connectivity, so this profile-clone capability is undeclared and not covered by any harm carve-out.