The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions explicitly require the user to disable the AI agent's security sandbox by starting it with the --sandbox danger-full-access flag. This removes the critical isolation between the AI and the host system, giving the agent and the code it executes unrestricted access to the local filesystem and network resources.
[COMMAND_EXECUTION]: The skill provides shell commands for environment setup, including npm install playwright and npm install --save-dev electron. While these target well-known packages, the instructions to run them in an unsandboxed environment increases the risk of local command abuse.
[DYNAMIC_EXECUTION]: The core functionality of the skill involves using js_repl to run arbitrary JavaScript code. In the context of a disabled sandbox, this allows the agent to execute any system-level Node.js APIs or shell commands beyond the scope of UI automation.
[INDIRECT_PROMPT_INJECTION]: The skill interacts with external web pages and Electron applications that may contain malicious instructions. Because the sandbox is disabled, the agent is highly vulnerable to these attacks, which could lead to unauthorized actions on the host machine.
Ingestion points: External web content and Electron application windows loaded via page.goto() and electronLauncher.launch().
Boundary markers: None present; the instructions do not specify any delimiters or warnings to ignore instructions inside the processed content.
Capability inventory: Full host system access (filesystem, network, and subprocess management) is available due to the required sandbox bypass.
Sanitization: No sanitization or filtering of external data is performed before it is processed by the agent.

playwright-interactive