The Agent Skills Directory

[COMMAND_EXECUTION]: The browser-probe.js script executes the playwright-cli tool using Node.js execFileSync. This is the core mechanism used to test target URLs with different browser profiles (e.g., headless, stealth, or system Chrome). The command arguments are constructed programmatically, and while the tool interacts with external URLs, the use of execFileSync limits typical shell injection vulnerabilities.
[DYNAMIC_EXECUTION]: The skill dynamically generates temporary JSON configuration files in the system's temporary directory to pass launch options and initialization scripts to playwright-cli. These files are ephemeral and are deleted immediately after the probe step completes.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze data from untrusted external URLs (specifically HTTP response headers and HTML page titles). This information is used to detect bot protection providers like Cloudflare, Akamai, and DataDome. While this exposes the agent to untrusted content, the script uses specific regex patterns and status code checks to sanitize the findings before they are presented in the final report, effectively mitigating the risk of injection affecting the agent's behavior.

browser-probe