The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs the user to disable security protections by starting the agent with the --sandbox danger-full-access flag. This bypasses the execution environment's safety boundaries and grants the agent unrestricted access to the host system resources.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and interact with untrusted external data, creating a vulnerability surface for indirect attacks.
Ingestion points: Untrusted data enters the context through page.goto(TARGET_URL) and mobilePage.goto(MOBILE_TARGET_URL) as described in SKILL.md.
Boundary markers: There are no markers or instructions to delimit or ignore instructions that may be embedded in the retrieved web content.
Capability inventory: The skill possesses high-privilege capabilities including browser automation (chromium.launch), desktop app automation (electronLauncher.launch), and arbitrary JavaScript execution (page.evaluate, electronApp.evaluate).
Sanitization: The skill does not implement any sanitization or validation of the content retrieved from external URLs before interacting with it.
[DYNAMIC_EXECUTION]: The workflow relies on page.evaluate() and electronApp.evaluate() to execute dynamic JavaScript code within browser and Electron processes. In a non-sandboxed environment, this capability can be abused to perform unauthorized actions on the host system if the agent is manipulated by external content.
[COMMAND_EXECUTION]: The setup instructions require the execution of shell commands such as npm install playwright and node -e code execution. While these are standard for the tool's purpose, executing them in a environment where sandboxing is explicitly disabled significantly increases the risk to the host system.

playwright-interactive