The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the bash tool to execute playwright-cli commands. These commands are constructed by interpolating variables such as profile names, target origins, and session storage keys/values directly from the .playwright/profiles.json configuration file. The lack of explicit sanitization for these values poses a risk of command injection if the project's configuration file is maliciously crafted.
[DATA_EXFILTRATION]: To restore authenticated sessions, the skill accesses storageState JSON files located in the .playwright/profiles/ directory. These files contain sensitive session data, including cookies and localStorage tokens. While this access is central to the skill's functionality, it involves the exposure of credentials stored on the local filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from web pages to determine session validity. 1. Ingestion points: The agent reads text content and element snapshots of target web pages via the snapshot command. 2. Boundary markers: No delimiters or safety warnings are specified to separate untrusted page content from the agent's internal instructions. 3. Capability inventory: The skill has access to the playwright-cli for browser navigation and session management via the bash tool. 4. Sanitization: No sanitization or filtering logic is defined for the snapshots obtained from external websites before processing.

use-profiles