The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructions explicitly direct the agent to use a 'Raw-script fallback' method. This involves the agent writing and executing one-off Node.js scripts against the Playwright library to perform tasks that the CLI cannot express, such as response-body harvesting or performance metrics. This pattern of generating and executing code at runtime increases the risk of the agent performing unintended or malicious operations.
[DATA_EXPOSURE]: Both the live screencast script (scripts/screencast-mjpeg.js) and the trace viewer documentation specify listening on all network interfaces (0.0.0.0). This configuration can expose sensitive browser content, including session cookies, internal application data, and user interactions, to any entity on the local network if not properly firewalled.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with 'any internal or external web app' and uses playwright-cli snapshot to ingest page content and accessibility trees into the agent's context. This creates a surface for indirect prompt injection, where malicious content on a visited website could potentially influence the agent's actions.
Ingestion points: Page content and accessibility tree snapshots retrieved via playwright-cli snapshot (SKILL.md).
Boundary markers: None identified in the provided instructions or scripts.
Capability inventory: Subprocess execution via playwright-cli, arbitrary Node.js script execution via the raw-script fallback, and network listeners in scripts/screencast-mjpeg.js.
Sanitization: No evidence of input sanitization or filtering of browser-retrieved content before it is processed by the agent.

playwright-cli