The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates by navigating to and interacting with external web pages, creating a surface for indirect prompt injection. Malicious content on these pages could potentially influence the agent's actions, such as manipulating the PR process.
Ingestion points: Browser session snapshots and page content processed via playwright-cli in files like SKILL.md.
Boundary markers: None present in the instructions to distinguish untrusted web content from agent instructions.
Capability inventory: Execution of playwright-cli, gh, git, and local file writing across the entire skill workflow.
Sanitization: The instructions do not specify any validation or sanitization of content retrieved from the browser before it is processed by the agent.
[CREDENTIALS_UNSAFE]: The workflow involves saving and loading browser authentication state using a playwright-auth.json file. While the skill attempts to prevent this file from being committed to the repository by modifying the git exclude list, storing unencrypted session tokens in the workspace creates a risk of credential exposure if the environment is compromised.
[DATA_EXFILTRATION]: The skill utilizes the gh CLI to attach files to pull requests. This capability allows for the transfer of local files to GitHub's infrastructure. If the agent is compromised by malicious instructions (e.g., via indirect prompt injection), this tool could be misused to exfiltrate sensitive files from the developer's environment by attaching them to a PR.

use-browser