The Agent Skills Directory

[COMMAND_EXECUTION]: The run-code and eval subcommands enable the execution of arbitrary JavaScript within the browser context. This allows the agent to interact with internal page state and browser APIs, which could be used to perform actions beyond simple automation if the agent's instructions are manipulated.
[CREDENTIALS_UNSAFE]: The skill provides tools for direct access to authentication and session data, including cookie-get, localstorage-get, and state-save. The documentation explicitly demonstrates saving a browser state file named auth.json, which typically contains sensitive session tokens.
[EXTERNAL_DOWNLOADS]: The skill documentation suggests using npx playwright-cli as an installation method. This command downloads and executes the playwright-cli package from the public NPM registry at runtime, creating a dependency on an external code source.
[DATA_EXFILTRATION]: Multiple commands facilitate the export of data from the browser session, such as state-save, screenshot, and pdf. These capabilities, combined with the ability to list cookies and storage, provide a path for exfiltrating sensitive user information or session credentials.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the content of visited web pages.
Ingestion points: playwright-cli goto, playwright-cli snapshot, and playwright-cli eval ingest content from the browser into the agent's context.
Boundary markers: No explicit delimiters or warnings are provided to the agent to ignore instructions embedded in the page content.
Capability inventory: The skill allows for file writes (screenshot, state-save), browser-based network actions, and arbitrary JavaScript execution (run-code).
Sanitization: There is no evidence of sanitization or filtering of the HTML/snapshot data before it is processed by the agent.

playwright-cli