The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary execution model is "code-as-action," where it writes Python scripts to the local workspace and executes them using the exec and Shell tools. This behavior is intentional but carries inherent risk as it executes arbitrary code generated at runtime.
[EXTERNAL_DOWNLOADS]: The setup instructions involve installing the playwright library and its corresponding browser binaries (Chromium and Firefox) from official package registries and well-known service providers.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external websites (such as ARIA snapshots, page titles, and URLs) and uses this information to determine subsequent code generation and execution steps.
Ingestion points: The agent reads website content via aria_snapshot(), page.url, page.title, and visual inspection of screenshots using the read_image tool.
Boundary markers: No explicit delimiters or instructions are used to distinguish untrusted web data from the agent's internal control logic.
Capability inventory: The skill has access to powerful capabilities including file system modification (write_file, edit_file), shell execution (exec, Shell), and persistent network access via the automated browser.
Sanitization: There is no evidence of sanitization or filtering applied to external web content before it is processed by the agent to guide script generation.

webwright