The Agent Skills Directory

[COMMAND_EXECUTION]: Arbitrary JavaScript execution via run-code and eval commands. The skill allows the agent to execute any JavaScript within the browser context, which can be used to bypass UI constraints or perform hidden actions.
[CREDENTIALS_UNSAFE]: The skill provides explicit commands to extract sensitive browser data, such as cookie-get, cookie-list, and localstorage-get. Additionally, the state-save command persists the entire browser context, including active session tokens, to a local file (e.g., auth.json).
[DATA_EXFILTRATION]: Documentation for the run-code command includes examples for reading the system clipboard using navigator.clipboard.readText(). This allows the agent to access potentially sensitive information copied from other applications on the host system.
[EXTERNAL_DOWNLOADS]: The documentation suggests the use of npx playwright-cli, which involves downloading and executing code from the npm registry at runtime if the package is not already installed.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it is designed to navigate to and process content from arbitrary web pages. Malicious instructions embedded in web content could potentially manipulate the agent's logic.
Ingestion points: Web page data accessed through playwright-cli open, playwright-cli goto, and playwright-cli snapshot.
Boundary markers: None implemented; web content is processed directly into the agent's context.
Capability inventory: Arbitrary script execution (run-code), network interception (route), and file system writes (state-save, screenshot).
Sanitization: No visible sanitization or filtering of content scraped from web pages.

playwright-cli