The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute system-level commands to install and run software, including apt-get install -y xvfb and xvfb-run. These commands typically require elevated privileges and modify the underlying system environment.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of patchright, which is a third-party fork of the Playwright automation library. Using non-standard forks of security-sensitive libraries increases the risk of supply chain attacks or unvetted code execution.
[CREDENTIALS_UNSAFE]: The instructions explicitly include logic for handling user logins, including asking the user for credentials at runtime. While it includes a warning not to store them, the process of inputting sensitive credentials into an automated browsing session creates a high risk of accidental logging or exposure to the target site and the agent's history.
[PROMPT_INJECTION]: The skill is designed to extract content from arbitrary external websites and feed it back to the agent. This creates a surface for indirect prompt injection attacks.
Ingestion points: Data is ingested via page.evaluate and browser_snapshot in SKILL.md when reading metadata, page titles, and article content.
Boundary markers: The skill lacks explicit instructions for using delimiters or boundary markers to isolate external web content from the agent's instructions.
Capability inventory: The skill possesses significant capabilities, including full network access, shell command execution (bash, node), and system package installation (apt-get).
Sanitization: There is no mention of sanitizing or escaping the extracted web content before it is processed by the agent.

playwright-stealth