The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates custom JavaScript automation scripts at runtime, writes them to the /tmp directory, and executes them using a wrapper script (run.js). The wrapper uses require() to load and execute these dynamically created files. It also supports executing arbitrary JavaScript code passed as command-line arguments.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to browse and extract data from external websites using locators and helper functions like extractTexts and extractTableData. This external content is untrusted and could contain malicious instructions intended to override the agent's behavior once ingested into the context. This vulnerability is present because the skill lacks explicit boundary markers or sanitization for the data retrieved from the browser.
Ingestion points: page.goto(), extractTexts(), extractTableData(), and page.content() calls in SKILL.md and lib/helpers.js.
Boundary markers: Absent. There are no instructions to the agent to treat browser-retrieved text as untrusted data.
Capability inventory: File system writes (to /tmp), network requests (via Playwright API), and screenshot capabilities.
Sanitization: Absent.
[EXTERNAL_DOWNLOADS]: The skill's setup process (npm run setup) involves downloading the Playwright library and the Chromium browser binary from official registries. While these are reputable sources, the skill relies on fetching these external components to function.

playwright-skill