The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The run.js script contains an installPlaywright function that uses execSync to run npm install and npx playwright install. This allows the skill to download and execute arbitrary code from the public NPM registry at runtime without prior user consent.
[REMOTE_CODE_EXECUTION]: The execution engine in run.js implements a dynamic code loading pattern. It writes JavaScript code (which could be generated by the agent or provided via input) to a temporary file .temp-execution-*.js and then executes it using require(). This enables arbitrary JavaScript execution on the local host.
[COMMAND_EXECUTION]: In lib/helpers.js, the launchBrowser function launches Chromium with the --no-sandbox and --disable-setuid-sandbox flags by default. This intentionally weakens the browser's security model, increasing the risk of a full system compromise if the browser interacts with a malicious website.
[DATA_EXFILTRATION]: The detectDevServers function in lib/helpers.js performs local network reconnaissance. It iterates through a list of common development ports (3000, 8080, etc.) on localhost to identify active services, which could be used to discover and target other local applications.
[PROMPT_INJECTION]: The skill is designed to process content from arbitrary, untrusted web pages while having full local command execution and file system access. This creates a significant attack surface for Indirect Prompt Injection, where instructions embedded on a webpage could trick the agent into performing malicious actions on the user's local machine.
[CREDENTIALS_UNSAFE]: The inclusion of a large, unrelated Prisma schema (prisma/schema.prisma) that contains detailed models for managing encrypted credentials, IVs, and authentication tags is highly suspicious. This database infrastructure is not required for basic browser automation and suggests the presence of dormant or unauthorized credential management features.

playwright-browser-automation