The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses importlib.util and exec_module to load and run Python modules from the jobs/ directory. These scripts are generated from templates and modified by the agent. Although the skill enforces an AST-based linting gate to block dangerous calls and validates file paths using strict regex constraints, the runtime execution of dynamically authored code is a significant capability surface.\n- [INDIRECT_PROMPT_INJECTION]: The skill drives a browser to interact with untrusted external websites. During the 'repair' workflow, the agent is instructed to read the captured DOM of a failed run (failure.html), which could contain malicious instructions designed to subvert agent behavior. \n
Ingestion points: The run_job function in scripts/job.py captures the full page content using page.content() and saves it to a failure bundle.\n
Boundary markers: None identified. The instructions do not specify using delimiters or warnings when presenting the untrusted DOM content to the agent for analysis.\n
Capability inventory: The skill can execute Python scripts, write to the local file system, and perform browser interactions (clicks, typing, navigation) via the Playwright API.\n
Sanitization: The captured DOM is truncated to 400,000 characters, but no content sanitization or instruction-filtering is performed.\n- [DATA_EXFILTRATION]: The skill manages persistent browser identities, including cookies and saved logins, stored in the .stealth/ directory. It also creates run artifacts such as screenshots and network traces. While the documentation emphasizes keeping these files gitignored, they represent a significant local exposure surface for sensitive user session data.

playwright-stealth-job