The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses AsyncFunction in scripts/run.mjs to execute JavaScript code generated at runtime. In interactive mode, it also starts a local HTTP server on 127.0.0.1 that exposes an unauthenticated /exec endpoint, allowing arbitrary code execution.
[DATA_EXFILTRATION]: The runtime sandbox in scripts/run.mjs provides access to the fs.readFileSync and fs.writeFileSync functions. When combined with Playwright's network capabilities, this enables the potential reading and exfiltration of sensitive local data.
[COMMAND_EXECUTION]: The scripts/browser.mjs file executes external binaries, specifically ffmpeg, using child_process.spawn and child_process.execFileSync to support the video recording feature.

web-test