The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/mcp-client.py utility uses subprocess.Popen with shell=True to execute commands provided via the --stdio argument, which is used for managing local MCP server processes.
[REMOTE_CODE_EXECUTION]: The scripts/start-server.sh script utilizes npx to fetch and run the latest version of the @playwright/mcp server from the official npm registry at runtime.
[DATA_EXFILTRATION]: The browser_file_upload tool, documented in references/playwright-tools.md, accepts absolute file paths. This capability could be exploited to access and upload sensitive local files if the agent is directed to a malicious website or receives malicious instructions via indirect prompt injection.
[DYNAMIC_EXECUTION]: The skill includes tools such as browser_run_code and browser_evaluate that allow for the execution of arbitrary JavaScript snippets within the browser context.
[INDIRECT_PROMPT_INJECTION]: The skill interacts with untrusted web content, creating a vulnerability surface for indirect prompt injection.
Ingestion points: Untrusted data from the web enters the agent's context through tools like browser_snapshot, browser_evaluate, and page navigation.
Boundary markers: There are no clear boundary markers or instructions to the agent to disregard instructions found within web content.
Capability inventory: The skill has access to the local filesystem (for uploads), the ability to execute code in the browser, and the ability to run shell commands via the client script.
Sanitization: Content retrieved from the internet is not sanitized or filtered before being presented to the agent.

browsing-with-playwright