The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends installing @playwright/cli via npm. This package is not a recognized official package from the Playwright project (official packages are typically playwright or @playwright/test), posing a potential supply chain risk.
[REMOTE_CODE_EXECUTION]: The run-code and eval commands allow for the execution of arbitrary JavaScript within the browser context. This provides a mechanism for an agent to be directed to execute malicious logic if instructions are manipulated.
[DATA_EXFILTRATION]: The skill possesses extensive capabilities to read and export sensitive browser data, including cookies, localStorage, and sessionStorage. This data can be written to the local file system or exfiltrated through the agent's network capabilities.
[CREDENTIALS_UNSAFE]: The state-save and state-load features facilitate the storage of authentication states (including session tokens) in local JSON files like auth.json. While common in automation, storing credentials in plain text on disk is a high-risk practice.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because it ingests and processes untrusted data from external websites.
Ingestion points: Browser snapshots, page evaluations, console logs, and network request monitoring (SKILL.md, references/tracing.md).
Boundary markers: None detected; there are no instructions for the agent to distinguish between its own goals and instructions embedded in the web content it retrieves.
Capability inventory: Full browser control, file system writes (state, traces, videos), and shell command execution via the playwright-cli tool.
Sanitization: No sanitization or filtering of retrieved web content is performed before it is presented to the agent context.

playwright-cli