The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The run-code command allows for the execution of arbitrary JavaScript within the browser context. This capability can be used to perform actions not natively supported by the CLI, such as interacting with internal browser APIs or bypassing page-level security. Evidence found in references/running-code.md and SKILL.md.
[CREDENTIALS_UNSAFE]: The skill provides numerous ways to access and save sensitive session data. playwright-cli state-save exports cookies and local storage into a JSON file, which may contain authentication tokens or session identifiers. cookie-list, cookie-get, localstorage-list, and sessionstorage-list provide direct access to these values in the console output. Evidence found in references/storage-state.md and SKILL.md.
[DATA_EXFILTRATION]: Comprehensive monitoring tools like playwright-cli network and playwright-cli tracing-start record all network traffic, including full request/response headers and bodies. This poses a significant risk if the agent interacts with sites containing sensitive PII or secrets. Evidence found in references/tracing.md.
[DYNAMIC_EXECUTION]: The tool relies on dynamic execution of scripts passed as arguments to the run-code command. This pattern is inherently risky as it bypasses static analysis and allows for runtime behavior modification. Evidence found in references/running-code.md.
[INDIRECT_PROMPT_INJECTION]: As the skill is designed to navigate and extract data from external websites, it is vulnerable to indirect prompt injection. A malicious website could include hidden instructions in its HTML or metadata to manipulate the agent's subsequent actions. Ingestion point: Browser snapshots and page content in SKILL.md. Boundary markers: Absent. Capability inventory: run-code (RCE), state-save (file write), and browser-based network access. Sanitization: Absent.

playwright-cli