The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from external web pages through commands like snapshot and eval. This creates a surface for indirect prompt injection where malicious instructions embedded in a website could attempt to influence the agent's actions.
Ingestion points: Data extracted from the browser via DOM snapshots, console logs, and script evaluation results.
Boundary markers: The skill does not define specific delimiters or warnings to isolate untrusted web content from the agent's instruction stream.
Capability inventory: The agent has extensive browser control, including navigation, form submission, and execution of arbitrary JavaScript.
Sanitization: No sanitization or filtering of content retrieved from the browser is mentioned in the instructions or scripts.
[DYNAMIC_EXECUTION]: The skill provides eval and run-code commands that allow the execution of arbitrary JavaScript within the browser context or the Playwright environment. This is a core functionality required for browser automation but represents a dynamic execution vector.
[EXTERNAL_DOWNLOADS]: The playwright_cli.sh script uses npx to fetch and execute the @playwright/cli package from the npm registry. This is an official tool maintained by a well-known technology company and is treated as a safe dependency for the intended use case.

playwright