The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill implements a run-code command in references/playwright-cli-ref-running-code.md that allows for the execution of arbitrary JavaScript code blocks within the browser context. This capability enables the agent to dynamically execute logic that is not constrained by the static CLI commands, creating a potential vector for executing malicious code if supplied by an untrusted source.\n- [DATA_EXFILTRATION]: Several features facilitate the access and extraction of sensitive data from the browser environment: \n
The state-save command and associated examples in references/playwright-cli-ref-storage-state.md allow for the export of full browser storage states, including session cookies and localStorage.\n
Code examples in references/playwright-cli-ref-running-code.md demonstrate reading from the system clipboard via navigator.clipboard.readText().\n
Network interception tools in references/playwright-cli-ref-request-mocking.md enable the capture of request bodies and headers, which may contain sensitive authentication tokens or user data.\n- [PROMPT_INJECTION]: The skill exhibits vulnerabilities related to both indirect injection and metadata poisoning: \n
Indirect Injection Surface: The agent can load and process untrusted content from the web via goto, snapshot, and page.content() commands. \n
Capability Inventory: High-impact tools such as arbitrary code execution (run-code), storage manipulation (state-save), and form interaction are available to the agent for exploitation. \n
Boundary Markers and Sanitization: There are no mechanisms documented to delimit external data from agent instructions or to sanitize web content before processing.\n
Metadata Poisoning: The skill's metadata in SKILL.md claims the author is "Microsoft", which conflicts with the actual author context. This discrepancy is deceptive and could mislead users or agents regarding the skill's trustworthiness.\n- [CREDENTIALS_UNSAFE]: The skill explicitly handles and saves authentication states to local files (e.g., auth.json). While the documentation provides warnings against committing these files to version control, the built-in functionality makes it easy to harvest and export valid session credentials.\n- [COMMAND_EXECUTION]: The core functionality of the skill relies on executing the playwright-cli binary with various arguments and injected code strings, providing a direct interface for shell-based command execution for browser control.

playwright-cli