The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the @playwright/cli package from the official NPM registry using npx (as seen in scripts/playwright_cli.sh). This is standard behavior for ensuring the required tooling is available without global installation.
[COMMAND_EXECUTION]: A bash wrapper script (scripts/playwright_cli.sh) is used to execute browser automation commands. This script passes all arguments directly to the Playwright CLI via exec, allowing the agent to perform a wide range of terminal-based browser interactions.
[DATA_EXFILTRATION]: The skill provides tools to read and extract information from web pages, including snapshot for DOM structure, eval for executing JavaScript to retrieve data, and commands for capturing screenshots and PDFs. These capabilities are inherent to browser automation but could be used to retrieve sensitive information displayed within a browser session.
[PROMPT_INJECTION]: By navigating to and reading content from arbitrary external websites (via pwcli open and pwcli snapshot), the skill is exposed to indirect prompt injection. Malicious instructions embedded in a webpage's HTML or metadata could attempt to override the agent's logic or capture its context.
Ingestion points: Untrusted data enters the agent context through the snapshot command and eval results originating from external URLs.
Boundary markers: The instructions do not define explicit delimiters or 'ignore' instructions for content loaded from the browser.
Capability inventory: The agent can execute shell commands via the PWCLI wrapper and run arbitrary JavaScript in the browser context via eval and run-code.
Sanitization: No content sanitization or validation of the web page data is performed before it is processed by the agent.
[REMEDIATION_GUIDANCE]: To mitigate risks, the agent should treat all data extracted from the browser as untrusted. Users should be prompted for confirmation before the agent executes commands derived from web content. Implementing boundary markers and explicit 'ignore embedded instructions' prompts when processing snapshots can help reduce the impact of indirect prompt injection.

playwright