The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill documents and encourages the use of the run-code command, which executes arbitrary JavaScript or Node.js code within the browser and local environment.
Evidence: Examples in running-custom-code.md and advanced-workflows.md show the execution of custom scripts, including the use of Node.js core modules like fs (file system) to read local fixtures.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from untrusted websites while possessing high-privilege capabilities, creating a significant indirect prompt injection surface.
Ingestion points: The agent reads external content via open, snapshot, and various scraping patterns defined in advanced-workflows.md and test-generation.md.
Boundary markers: There are no instructions or delimiters provided to help the agent distinguish between skill instructions and potentially malicious instructions embedded in the web pages being automated.
Capability inventory: The skill provides the agent with the ability to execute code (run-code), read/write files (upload, download, screenshot, pdf), and access authentication artifacts (state-save).
Sanitization: No sanitization, validation, or filtering of ingested web content is performed before the agent processes it.
[DATA_EXFILTRATION]: The skill includes features for managing and accessing sensitive browser storage, including authentication cookies and tokens.
Evidence: storage-and-auth.md details the usage of state-save, cookie-list, and localstorage-get, which allow for the extraction of session credentials. Additionally, the upload command allows the agent to read arbitrary files from the local system for use in web forms.
[COMMAND_EXECUTION]: The skill relies on the execution of the playwright-cli tool and its subcommands to perform all automation tasks.
Evidence: The entire skill is built around providing instructions and examples for executing these CLI commands to drive browser behavior.

playwright-cli