The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill navigates to and processes content from external web pages (using goto, snapshot, and webmcp-list), which creates a surface for malicious instructions to be injected into the agent's context.
Ingestion points: Web content retrieved via playwright-cli goto, snapshot, and webmcp-list (SKILL.md).
Boundary markers: The instructions do not define explicit delimiters to separate retrieved page data from instructions in the prompt context.
Capability inventory: The skill has broad capabilities including file writes (state-save, screenshot), network access (via the browser), and arbitrary shell command execution via the allowed Bash tools.
Sanitization: The documentation in SKILL.md includes an explicit warning to treat page-provided WebMCP tools as untrusted input rather than instructions.
[DYNAMIC_EXECUTION]: The playwright-cli run-code and playwright-cli eval commands allow for the execution of arbitrary JavaScript within the browser's context. While the documentation states this is isolated from the host Node.js environment (no access to require or process), it allows for complex manipulation of page data and security-sensitive browser APIs.
[EXTERNAL_DOWNLOADS]: The skill instructions recommend installing the CLI tool via npm install -g @playwright/cli@latest and using npx to execute Playwright, which involves fetching code from the public NPM registry.
[COMMAND_EXECUTION]: The skill extensively uses shell commands to interact with browser automation tools, system utilities like jq, and version control tools like gh for PR attachments.

playwright-cli