The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements run-code and eval commands which allow the execution of arbitrary JavaScript and Playwright code within the browser context. This functionality, while powerful for automation, permits the runtime assembly and execution of code that can be manipulated or supplied by external inputs.
[DATA_EXFILTRATION]: The state-save and state-load mechanisms allow for the complete extraction and restoration of browser session data, including cookies, localStorage, and sessionStorage. This represents a significant risk for the exposure of sensitive authentication tokens and session credentials if the resulting JSON files are mishandled or targeted by an attacker.
[INDIRECT_PROMPT_INJECTION]: The skill is highly vulnerable to indirect injection attacks because it regularly ingests untrusted data from the open web.
Ingestion points: Untrusted data enters the agent context through the open and snapshot commands (referenced in SKILL.md and references/cli-reference.md).
Boundary markers: The instructions do not define explicit delimiters or warnings to ignore instructions embedded within the processed web content.
Capability inventory: The skill possesses high-privilege capabilities including arbitrary code execution (run-code, eval), sensitive file creation (state-save), and various file system write operations (screenshot, pdf, video-start, tracing-start).
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from external URLs before it is processed by the agent.
[COMMAND_EXECUTION]: The skill facilitates the execution of shell commands through the playwright-cli interface and external tools like npx playwright test. These commands allow the agent to perform complex operations on the local system and network which could be abused if the agent's logic is subverted.

playwright-cli