agentic-actions-audito…
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Diagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratically.
Claude Code
$ npx -y skills add trailofbits/skills --skill chrome-mcp-troubleshooting --agent claude-code
Codex
$ npx skills add trailofbits/skills --skill chrome-mcp-troubleshooting -a codex -y
Cursor
$ npx skills add trailofbits/skills --skill chrome-mcp-troubleshooting -a cursor -y
Gemini CLI
$ npx skills add trailofbits/skills --skill chrome-mcp-troubleshooting -a gemini-cli -y
GitHub Copilot
$ npx skills add trailofbits/skills --skill chrome-mcp-troubleshooting -a github-copilot -y
OpenCode
$ npx skills add trailofbits/skills --skill chrome-mcp-troubleshooting -a opencode -y
Windsurf
$ npx skills add trailofbits/skills --skill chrome-mcp-troubleshooting -a windsurf -y
name: chrome-mcp-troubleshooting description: Diagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratically.
Use this skill when Claude in Chrome MCP tools fail to connect or work unreliably.
**Background:** When Claude.app added Cowork support (browser automation from the desktop app), it introduced a competing native messaging host that conflicts with Claude Code CLI.
| Component | Native Host Binary | Socket Location | |-----------|-------------------|-----------------| | **Claude.app (Cowork)** | `/Applications/Claude.app/Contents/Helpers/chrome-native-host` | `/tmp/claude-mcp-browser-bridge-$USER/<PID>.sock` | | **Claude Code CLI** | `~/.local/share/claude/versions/<version> --chrome-native-host` | `$TMPDIR/claude-mcp-browser-bridge-$USER` (single file) |
1. Both register native messaging configs in Chrome:
2. Chrome extension requests a native host by name 3. If the wrong config is active, the wrong binary runs 4. The wrong binary creates sockets in a format/location the MCP client doesn't expect 5. Result: "Browser extension is not connected" even though everything appears to be running
**If you use Claude Code CLI for browser automation (not Cowork):**
# Disable the Claude.app native messaging config mv ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_browser_extension.json \ ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_browser_extension.json.disabled # Ensure the Claude Code config exists and points to the wrapper cat ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_code_browser_extension.json
**If you use Cowork (Claude.app) for browser automation:**
# Disable the Claude Code native messaging config mv ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_code_browser_extension.json \ ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_code_browser_extension.json.disabled
**You cannot use both simultaneously.** Pick one and disable the other.
Add this to `~/.zshrc` or run directly:
chrome-mcp-toggle() {
local CONFIG_DIR=~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts
local CLAUDE_APP="$CONFIG_DIR/com.anthropic.claude_browser_extension.json"
local CLAUDE_CODE="$CONFIG_DIR/com.anthropic.claude_code_browser_extension.json"
if [[ -f "$CLAUDE_APP" && ! -f "$CLAUDE_APP.disabled" ]]; then
# Currently using Claude.app, switch to Claude Code
mv "$CLAUDE_APP" "$CLAUDE_APP.disabled"
[[ -f "$CLAUDE_CODE.disabled" ]] && mv "$CLAUDE_CODE.disabled" "$CLAUDE_CODE"
echo "Switched to Claude Code CLI"
echo "Restart Chrome and Claude Code to apply"
elif [[ -f "$CLAUDE_CODE" && ! -f "$CLAUDE_CODE.disabled" ]]; then
# Currently using Claude Code, switch to Claude.app
mv "$CLAUDE_CODE" "$CLAUDE_CODE.disabled"
[[ -f "$CLAUDE_APP.disabled" ]] && mv "$CLAUDE_APP.disabled" "$CLAUDE_APP"
echo "Switched to Claude.app (Cowork)"
echo "Restart Chrome to apply"
else
echo "Current state unclear. Check configs:"
ls -la "$CONFIG_DIR"/com.anthropic*.json* 2>/dev/null
fi
}Usage: `chrome-mcp-toggle` then restart Chrome (and Claude Code if switching to CLI).
# 1. Which native host binary is running? ps aux | grep chrome-native-host | grep -v grep # Claude.app: /Applications/Claude.app/Contents/Helpers/chrome-native-host # Claude Code: ~/.local/share/claude/versions/X.X.X --chrome-native-host # 2. Where is the socket? # For Claude Code (single file in TMPDIR): ls -la "$(getconf DARWIN_USER_TEMP_DIR)/claude-mcp-browser-bridge-$USER" 2>&1 # For Claude.app (directory with PID files): ls -la /tmp/claude-mcp-browser-bridge-$USER/ 2>&1 # 3. What's the native host connected to? lsof -U 2>&1 | grep claude-mcp-browser-bridge # 4. Which configs are active? ls ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic*.json
**MCP connects at startup.** If the browser bridge wasn't ready when Claude Code started, the connection will fail for the entire session. The fix is usually: ensure Chrome + extension are running with correct config, THEN restart Claude Code.
# 1. Ensure correct config is active mv ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_browser_extension.json \ ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_browser_extension.json.disabled 2>/dev/null # 2. Update the wrapper to use latest Claude Code version cat > ~/.claude/chrome/chrome-native-host << 'EOF
Trail of Bits skills and plugins for AI-assisted security analysis, testing, and development. Install this marketplace in Claude Code or Codex, or import it into your ChatGPT workspace marketplace.
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on…
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing…
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools,…
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging…
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing…
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…