The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides tools for agents to visit external websites and ingest their content through accessibility snapshots. This creates an attack surface where instructions embedded in a webpage could potentially influence or hijack the agent's logic.
Ingestion points: The browser_snapshot tool returns the page's accessibility tree (text and element structure) to the agent's context in SKILL.md.
Boundary markers: The instructions provided to the agent ("Use the browser tools to complete the task. Act on element refs from the snapshots.") do not include delimiters or warnings to treat the snapshot data as untrusted.
Capability inventory: The skill provides capabilities for network navigation (browser_visit), interacting with sensitive forms (browser_fill), and writing files to the local filesystem (browser_screenshot).
Sanitization: No sanitization, filtering, or validation of the external page content is mentioned before it is processed by the agent.
[COMMAND_EXECUTION]: The skill exposes tools and CLI commands that interact directly with the operating system and filesystem.
The browser_screenshot tool accepts a path argument, which grants the agent the capability to write files to the local disk. Without strict path validation, this could be used to write data to unintended or sensitive locations.
The documentation describes CLI utilities such as bxPlaywright mcp and bxPlaywright codegen (e.g., bxPlaywright codegen http://localhost:8080 --output=flow.bxs), which involve shell execution and writing output to files.

bx-playwright-ai