The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill automates web browsers, which involves ingesting untrusted data from external websites that could contain malicious instructions.
Ingestion points: The open and snapshot commands in SKILL.md allow the agent to read arbitrary content from any URL.
Boundary markers: The instructions lack explicit requirements for using delimiters or "ignore embedded instructions" warnings when the agent processes content retrieved from web pages.
Capability inventory: The scripts/playwright_cli.sh wrapper provides broad interaction capabilities including click, fill, type, and press, which could be manipulated by content on a malicious page.
Sanitization: There is no evidence of DOM sanitization or filtering before the agent interprets the snapshot data.
Mitigation: Consider wrapping external content in clear delimiters and providing an explicit instruction to ignore any commands found within the web data.
[EXTERNAL_DOWNLOADS]: The skill fetches the official @playwright/cli package from the NPM registry to perform browser automation.
Evidence: scripts/playwright_cli.sh uses npx --package @playwright/cli to dynamically download and run the tool.
Note: This utilizes a well-known package from a reputable registry.
[COMMAND_EXECUTION]: The skill uses a shell script to wrap and execute Playwright commands.
Evidence: The scripts/playwright_cli.sh script constructs a command array and uses exec "${cmd[@]}" to run the utility with user-provided arguments.

playwright