The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, potentially untrusted web pages through the mcp_playwright_browser_snapshot tool. This creates a surface for indirect prompt injection where malicious content on a webpage could attempt to influence the agent's behavior.
Ingestion points: Web page content is ingested via mcp_playwright_browser_snapshot in SKILL.md.
Boundary markers: The skill suggests using snapshots to understand state but does not explicitly define sanitization boundaries for the ingested DOM content.
Capability inventory: The skill possesses powerful capabilities including mcp_playwright_browser_evaluate, mcp_playwright_browser_run_code_unsafe, mcp_playwright_browser_file_upload, and CLI run_command access.
Sanitization: While the skill provides guidelines for managing authentication state safely, there is no mention of sanitizing or escaping the content retrieved from external websites before processing.
[DYNAMIC_EXECUTION]: The skill provides tools for executing arbitrary code within the browser environment, which is a core part of its functionality.
Evidence: The tools mcp_playwright_browser_evaluate and mcp_playwright_browser_run_code_unsafe allow for the execution of arbitrary JavaScript functions and Playwright scripts as described in SKILL.md.
[COMMAND_EXECUTION]: The skill allows for the execution of system commands as a fallback mechanism.
Evidence: The documentation in SKILL.md specifies using run_command for tasks such as browser installation via npx playwright install.

browser-automation