The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions require the agent to execute generated Node.js scripts using the node command on files stored in the /tmp/ directory.
[DYNAMIC_EXECUTION]: The skill's core functionality relies on the agent generating JavaScript code (.cjs files) at runtime and executing it. It also utilizes page.evaluate() to run arbitrary JavaScript code within the browser context, which can be used to interact with or extract data from web pages.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to navigate to and interact with external, potentially untrusted websites via page.goto(). This introduces a surface for indirect prompt injection if an attacker-controlled page contains instructions meant to be interpreted by the AI agent when it processes screenshots or console logs.
Ingestion points: Content from external URLs processed by the Playwright browser (found in SKILL.md).
Boundary markers: The skill does not provide specific delimiters or instructions for the agent to treat web content as untrusted data.
Capability inventory: The agent has the ability to write to the filesystem (/tmp/), execute shell commands (node), and perform network operations via the browser (clicks, form filling, cookie management).
Sanitization: There is no evidence of sanitization or filtering of the external content before it is processed by the agent.
[DATA_EXPOSURE]: The skill instructions expose absolute filesystem paths (/Users/espen/node_modules/playwright) specific to the author's environment, providing information about the host's directory structure.

playwright