The Agent Skills Directory

[DYNAMIC_EXECUTION]: The run.js script allows for the execution of arbitrary JavaScript code provided via command-line arguments, files, or stdin. It uses require() to load a dynamically generated temporary file containing the provided code. While the skill is intended for browser automation, this pattern can be used to execute any Node.js code within the agent's environment.
[COMMAND_EXECUTION]: The skill uses execSync in run.js to perform npm install and browser installation. While these are part of the setup process, they involve shell execution.
[CREDENTIALS_UNSAFE]: The lib/helpers.js file contains an authenticate function designed to handle usernames and passwords. It also includes functions to extract HTTP headers from environment variables (PW_EXTRA_HEADERS, PW_HEADER_VALUE). If an attacker can influence the browser scripts executed by this skill, they could potentially capture or exfiltrate credentials used during automation sessions.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection because it is designed to browse and interact with arbitrary websites. Data ingested from these websites (e.g., text, table data) is returned to the agent context.
Ingestion points: Web pages processed by Playwright via extractTexts, extractTableData, and page.content() calls in lib/helpers.js or user scripts.
Boundary markers: None identified in the skill code to separate web content from instructions.
Capability inventory: Full file system access via fs, network operations via playwright and node:http, and arbitrary code execution via run.js.
Sanitization: No specific sanitization or filtering of extracted web content is performed before returning it to the agent.

playwright-v1