The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and interprets untrusted data from external web pages.
Ingestion points: Untrusted data enters the agent's context through commands like playwright-cli snapshot (which provides the page's accessibility tree), playwright-cli console (which retrieves browser console messages), and playwright-cli requests (which exposes network log data).
Boundary markers: There are no explicit boundary markers or instructions defined to prevent the agent from following instructions that may be hidden or embedded within the web content it processes.
Capability inventory: The skill provides the agent with powerful capabilities, including clicking elements, filling forms, selecting options, and executing arbitrary JavaScript within the browser context via the eval and run-code commands.
Sanitization: The instructions do not include mechanisms for sanitizing, filtering, or validating the content retrieved from external websites before the agent acts upon it.
[COMMAND_EXECUTION]: The skill relies on the execution of the playwright-cli binary to automate browser tasks.
The tool allows for the execution of dynamic scripts in the browser environment using the eval command (e.g., playwright-cli eval "el => el.getAttribute('data-testid')" e5).
It includes commands that interact with the local file system for session management, such as state-save and state-load which write to and read from JSON files like auth.json.

playwright-cli