The Agent Skills Directory

[COMMAND_EXECUTION]: The skill exposes a comprehensive CLI interface (playwright-cli) allowing the agent to perform a wide range of browser interactions and shell-based automation tasks.
[REMOTE_CODE_EXECUTION]: The run-code command enables the execution of arbitrary JavaScript within the browser context. Documentation in references/running-code.md explicitly shows how to use this for file system operations (download.saveAs) and complex page manipulation, which could be exploited to run malicious scripts.
[CREDENTIALS_UNSAFE]: The skill facilitates the management of sensitive authentication data through commands like state-save, state-load, cookie-set, and cookie-get. These tools can be used to extract, store, or inject session tokens and cookies.
[DATA_EXFILTRATION]: Features such as screenshot, pdf, and eval allow for the extraction of data from web pages. Additionally, the run-code feature can be used to programmatically read the system clipboard and local storage.
[PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection because it fetches and processes content from external websites which is then returned to the agent.
Ingestion points: Untrusted data enters the agent context through playwright-cli snapshot, playwright-cli eval, and playwright-cli console outputs.
Boundary markers: Absent. The instructions do not specify any delimiters or warnings to the agent regarding the untrusted nature of the processed web content.
Capability inventory: The skill possesses capabilities for network requests (goto), file writing (screenshot, state-save), and arbitrary code execution (run-code).
Sanitization: Absent. There is no mechanism described for sanitizing or filtering web content before it is presented to the agent.

playwright-cli