The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill allows the execution of arbitrary JavaScript code within the browser context, which can be used to manipulate web pages or exfiltrate data from the browser environment.
Evidence: The run-code and eval commands documented in SKILL.md and references/running-code.md enable direct execution of user-supplied or agent-generated scripts.
[DATA_EXFILTRATION]: The skill provides tools to harvest sensitive session data and upload local files to remote servers.
Evidence: Commands such as cookie-get, localstorage-get, and state-save (documented in SKILL.md and references/storage-state.md) allow the extraction of authentication tokens and session identifiers. The upload command facilitates the transmission of local files to the automated browser session.
[INDIRECT_PROMPT_INJECTION]: The skill ingests content from external web pages, creating a vulnerability where malicious instructions embedded in a website could influence the agent's behavior.
Ingestion points: Web content retrieved via snapshot, eval results, and browser console logs (documented in SKILL.md).
Boundary markers: No explicit instructions for using delimiters or ignoring embedded instructions are present in the documentation.
Capability inventory: The agent has access to shell commands (playwright-cli), arbitrary JS execution (run-code), and filesystem interaction (state-save, upload).
Sanitization: No sanitization or filtering of external web data is described before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill includes functionality for downloading and installing external software components.
Evidence: The install-browser and install-skills commands in SKILL.md trigger external network requests to fetch and install binary components or additional skill definitions.

playwright-cli