The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a comprehensive suite of browser automation tools (browser_click, browser_type, browser_navigate, browser_lock, etc.) and specifically leverages the browser_run_code_unsafe tool to execute arbitrary JavaScript within the automation context.
[CREDENTIALS_UNSAFE]: The protocol manages sensitive session credentials by reading and writing browser storage states (cookies and localStorage) to local JSON files within the .playwright-mcp/auth/ directory. Although the skill correctly identifies these files as secrets and instructs users to exclude them from version control, the automated handling of session tokens on the local filesystem remains a security-sensitive operation.
[PROMPT_INJECTION]: The skill processes untrusted content from external web environments through various ingestion points, creating a surface for indirect prompt injection where malicious websites could attempt to influence the agent's logic or behavior.
Ingestion points: Web page data is ingested via browser_snapshot, browser_console_messages, and browser_network_requests (SKILL.md).
Boundary markers: No explicit instructions or delimiters are provided to the agent to treat external web data as untrusted or to ignore embedded instructions.
Capability inventory: The agent possesses extensive capabilities, including full browser control, form submission, and local filesystem interaction through the browser_run_code_unsafe tool (references/playwright-session-coordination.md).
Sanitization: There is no evidence of sanitization, filtering, or validation of the data retrieved from external URLs before it is processed by the agent.

protocol-browser-anti-stall