The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides the run-code and eval commands which allow the execution of arbitrary JavaScript.
run-code enables running complex Node.js/Playwright scripts in the host environment, as seen in references/running-code.md and references/authentication-patterns.md.
eval allows execution of JavaScript directly within the browser's DOM context, used frequently for inspecting attributes or manipulating the page.
[CREDENTIALS_UNSAFE]: Multiple commands are provided to extract sensitive authentication data from the browser context.
cookie-list, cookie-get, localstorage-list, and localstorage-get allow for the retrieval of session tokens and identifiers.
state-save and state-load facilitate saving the entire browser authentication state to local files, which could be targeted for exfiltration.
The skill documentation in references/authentication-patterns.md demonstrates handling MFA/TOTP secrets and manual cookie injection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external web pages, creating a vulnerability to instructions embedded in third-party content.
Ingestion points: Browser state snapshots generated by playwright-cli snapshot and data returned by playwright-cli eval are read directly into the agent's context.
Boundary markers: There are no explicit instructions or delimiters in the skill to prevent the agent from following commands found within the web page content.
Capability inventory: The skill has access to sensitive data (cookies), file system writes (screenshots, state files), and arbitrary code execution (run-code).
Sanitization: No sanitization logic is present to filter or escape content retrieved from web pages before it is processed by the agent.
[COMMAND_EXECUTION]: The skill relies on executing CLI commands via playwright-cli, and provides instructions for using npm and npx to manage the environment and run tests.
[EXTERNAL_DOWNLOADS]: The skill includes instructions to install the Playwright CLI tool globally using npm install -g @playwright/cli@latest and to download browser binaries via npx playwright install.

playwright-cli