The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requests and processes plaintext email and password credentials via the AskUserQuestion tool during authentication setup. Although the instructions explicitly state that credentials must be held in memory only and never written to disk, task metadata, or output files, the handling of raw secrets in plaintext is a sensitive operation.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from markdown files and interprets natural language steps as browser actions, which could be exploited if the source files are compromised.
Ingestion points: Reads workflow definitions from files matching the pattern /workflows/*-workflows.md (SKILL.md Phase 1).
Boundary markers: Absent; the agent is instructed to parse the file content directly into actionable execution steps without explicit delimiters or safety warnings regarding embedded instructions.
Capability inventory: Bash (full shell command execution), Write (file system modification), Read (file system access), and AskUserQuestion (user interaction).
Sanitization: Absent; the skill relies on the agent's internal logic to map natural language to a predefined set of playwright-cli commands, which may not account for adversarial payloads in the workflow text.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to execute playwright-cli commands. These commands are dynamically constructed using arguments derived from external workflow files and user-supplied parameters (e.g., --url), which could lead to command injection if not properly quoted or sanitized by the platform.
[DYNAMIC_EXECUTION]: The skill executes dynamic JavaScript within the browser context using the playwright-cli eval command. This is used for performing DOM assertions, checking element visibility, and executing complex interactions like scrollIntoView and Shadow DOM detection.

playwright-runner