The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install the CLI tool @jackwener/opencli and the @playwright/mcp bridge from untrusted NPM scopes. It also suggests cloning a source repository from a personal GitHub account.
[CREDENTIALS_UNSAFE]: Documentation provides patterns for extracting sensitive auth_token values from localStorage and sessionStorage, and for reusing browser cookies via fetch with credentials: 'include'. It also requires the user to manage a PLAYWRIGHT_MCP_EXTENSION_TOKEN.
[DYNAMIC_EXECUTION]: The skill implements a dynamic adapter loader that imports and executes arbitrary TypeScript or YAML files placed in the clis/ directory, allowing for runtime code execution that could be exploited by malicious adapters.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to scrape and process content from arbitrary external websites, which serves as a significant attack surface for indirect prompt injection if the ingested data contains malicious instructions targeting the agent.
Ingestion points: Website DOM elements and API responses extracted in SKILL.md via page.evaluate().
Boundary markers: No delimiters or "ignore" instructions are present in the provided adapter patterns.
Capability inventory: Full browser automation control, network request capabilities, and command execution via the opencli tool.
Sanitization: The documented patterns show raw data extraction from the DOM without any visible sanitization or validation steps.
[PERSISTENCE]: The skill recommends adding environment variables (containing sensitive tokens) to persistent shell configuration files like ~/.zshrc or ~/.bashrc.
[COMMAND_EXECUTION]: The skill requires the execution of multiple CLI commands (opencli setup, opencli doctor, npm install -g) which perform system-level configuration and diagnostic tasks.

opencli-web-automation