The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses the npx command within its wrapper script scripts/playwright_cli.sh to fetch and run the @playwright/cli package from the npm registry. This package is maintained by Microsoft, a trusted organization, and the download is a standard requirement for the skill's intended functionality.
[INDIRECT_PROMPT_INJECTION]: The skill's core workflow involves navigating to external websites and extracting data via DOM snapshots, text evaluation, and console monitoring. This creates a surface for indirect prompt injection attacks where a malicious website could provide instructions to the agent.
Ingestion points: Website content is ingested through pwcli snapshot, pwcli eval, and pwcli console commands (SKILL.md, references/workflows.md).
Boundary markers: The skill does not provide specific instructions or delimiters to help the agent distinguish between its own system instructions and the potentially malicious data retrieved from web pages.
Capability inventory: The skill has the ability to perform network requests, execute browser-level JavaScript, and perform file system operations like saving screenshots and traces.
Sanitization: There are no mechanisms described for sanitizing or filtering the content extracted from external web pages before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill documentation describes the use of eval and run-code commands, which allow for the execution of arbitrary JavaScript within the browser context. While this is a standard feature of browser automation, it represents a dynamic execution capability (references/cli.md).
[COMMAND_EXECUTION]: The wrapper script scripts/playwright_cli.sh executes the playwright-cli tool using the exec command. It passes through user-provided arguments directly to the tool, which is the expected behavior for a CLI integration.

playwright