The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to use npx playwriter@latest or bunx playwriter@latest if the tool is not found. This pattern downloads and executes code from the public NPM registry without pinning a specific version, which introduces a dependency on remote, unversioned code at execution time.
[COMMAND_EXECUTION]: The skill's core functionality is built around executing shell commands (e.g., playwriter session new, playwriter -e '...') to control the user's browser instance, including access to existing sessions, cookies, and authenticated sites.
[INDIRECT_PROMPT_INJECTION]: The skill file contains incomplete documentation and explicitly directs the agent to run playwriter skill to receive the full logic, selector strategies, and constraints. This creates an indirect prompt injection surface where the agent's behavior is governed by dynamic output from an external command rather than static, reviewed instructions.
Ingestion points: The output of the playwriter skill command is ingested as the primary source of instructions in SKILL.md.
Boundary markers: No delimiters or safety warnings are provided for the content returned by the CLI command.
Capability inventory: The skill has the capability to execute arbitrary JavaScript in the user's browser, manage sessions, and navigate to any URL via the playwriter CLI.
Sanitization: There is no evident sanitization or validation of the documentation content returned by the command before the agent processes it.

playwriter