agentic-actions-audito…
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI…
Diagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratically.
$ npx -y skills add trailofbits/skills --skill chrome-mcp-troubleshooting --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/chrome-mcp-troubleshootingContext preview
The summary Claude sees to decide when to auto-load this skill.
Diagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratically.
name: chrome-mcp-troubleshooting description: Diagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratically.
Use this skill when Claude in Chrome MCP tools fail to connect or work unreliably.
**Background:** When Claude.app added Cowork support (browser automation from the desktop app), it introduced a competing native messaging host that conflicts with Claude Code CLI.
| Component | Native Host Binary | Socket Location | |-----------|-------------------|-----------------| | **Claude.app (Cowork)** | `/Applications/Claude.app/Contents/Helpers/chrome-native-host` | `/tmp/claude-mcp-browser-bridge-$USER/<PID>.sock` | | **Claude Code CLI** | `~/.local/share/claude/versions/<version> --chrome-native-host` | `$TMPDIR/claude-mcp-browser-bridge-$USER` (single file) |
1. Both register native messaging configs in Chrome:
2. Chrome extension requests a native host by name 3. If the wrong config is active, the wrong binary runs 4. The wrong binary creates sockets in a format/location the MCP client doesn't expect 5. Result: "Browser extension is not connected" even though everything appears to be running
**If you use Claude Code CLI for browser automation (not Cowork):**
# Disable the Claude.app native messaging config mv ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_browser_extension.json \ ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_browser_extension.json.disabled # Ensure the Claude Code config exists and points to the wrapper cat ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_code_browser_extension.json
**If you use Cowork (Claude.app) for browser automation:**
# Disable the Claude Code native messaging config mv ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_code_browser_extension.json \ ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_code_browser_extension.json.disabled
**You cannot use both simultaneously.** Pick one and disable the other.
Add this to `~/.zshrc` or run directly:
chrome-mcp-toggle() {
local CONFIG_DIR=~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts
local CLAUDE_APP="$CONFIG_DIR/com.anthropic.claude_browser_extension.json"
local CLAUDE_CODE="$CONFIG_DIR/com.anthropic.claude_code_browser_extension.json"
if [[ -f "$CLAUDE_APP" && ! -f "$CLAUDE_APP.disabled" ]]; then
# Currently using Claude.app, switch to Claude Code
mv "$CLAUDE_APP" "$CLAUDE_APP.disabled"
[[ -f "$CLAUDE_CODE.disabled" ]] && mv "$CLAUDE_CODE.disabled" "$CLAUDE_CODE"
echo "Switched to Claude Code CLI"
echo "Restart Chrome and Claude Code to apply"
elif [[ -f "$CLAUDE_CODE" && ! -f "$CLAUDE_CODE.disabled" ]]; then
# Currently using Claude Code, switch to Claude.app
mv "$CLAUDE_CODE" "$CLAUDE_CODE.disabled"
[[ -f "$CLAUDE_APP.disabled" ]] && mv "$CLAUDE_APP.disabled" "$CLAUDE_APP"
echo "Switched to Claude.app (Cowork)"
echo "Restart Chrome to apply"
else
echo "Current state unclear. Check configs:"
ls -la "$CONFIG_DIR"/com.anthropic*.json* 2>/dev/null
fi
}Usage: `chrome-mcp-toggle` then restart Chrome (and Claude Code if switching to CLI).
# 1. Which native host binary is running? ps aux | grep chrome-native-host | grep -v grep # Claude.app: /Applications/Claude.app/Contents/Helpers/chrome-native-host # Claude Code: ~/.local/share/claude/versions/X.X.X --chrome-native-host # 2. Where is the socket? # For Claude Code (single file in TMPDIR): ls -la "$(getconf DARWIN_USER_TEMP_DIR)/claude-mcp-browser-bridge-$USER" 2>&1 # For Claude.app (directory with PID files): ls -la /tmp/claude-mcp-browser-bridge-$USER/ 2>&1 # 3. What's the native host connected to? lsof -U 2>&1 | grep claude-mcp-browser-bridge # 4. Which configs are active? ls ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic*.json
**MCP connects at startup.** If the browser bridge wasn't ready when Claude Code started, the connection will fail for the entire session. The fix is usually: ensure Chrome + extension are running with correct config, THEN restart Claude Code.
# 1. Ensure correct config is active mv ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_browser_extension.json \ ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_browser_extension.json.disabled 2>/dev/null # 2. Update the wrapper to use latest Claude Code version cat > ~/.claude/chrome/chrome-native-host << 'EOF
A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI…
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an…
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access…
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes…
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems,…
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls,…