The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill exposes tools for executing arbitrary code in the browser context, such as browser_evaluate and browser_run_code_unsafe. Additionally, the 'Widget-framework' guidance provides complex JavaScript snippets that manipulate native property descriptors (e.g., HTMLInputElement.prototype) to bypass standard application event handlers.
[INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted external data, creating an attack surface where a malicious website could influence the agent's behavior.
Ingestion points: The agent retrieves untrusted data through browser_navigate and browser_snapshot (accessibility tree data).
Boundary markers: The instructions do not define clear boundaries or 'ignore' instructions for the data ingested from the browser, allowing the agent to treat page content as a source for its next actions.
Capability inventory: The agent can execute arbitrary scripts, monitor all network traffic (browser_network_requests), and upload local files (browser_file_upload).
Sanitization: There is no evidence of sanitization or instruction-filtering applied to the page content captured by the tools.
[COMMAND_EXECUTION]: The skill is designed to work with the mcpc CLI tool, requiring the execution of shell commands to establish connections and invoke browser tools.
[DATA_EXFILTRATION]: The combined capabilities of browser_snapshot, browser_take_screenshot, and browser_network_requests allow for the collection of sensitive session data. If the agent is compromised via indirect prompt injection, these tools could be leveraged to exfiltrate information from a user's browser session.

playwright-mcp