The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the official Playwright container image from the Microsoft container registry (mcr.microsoft.com). This is a standard and expected operation for the skill's documented purpose.
[REMOTE_CODE_EXECUTION]: During container initialization, the skill executes npm install to download and install the playwright package from the official NPM registry. This execution is isolated within the Podman container.
[COMMAND_EXECUTION]: The script uses child_process.spawn to invoke podman on the host system. It correctly uses an argument array to pass parameters, which prevents command injection at the host level. The containerized environment is configured with --ipc=host and --init for stability.
[PROMPT_INJECTION]: The skill facilitates indirect prompt injection by design, as it allows the agent to ingest arbitrary content from the internet.
Ingestion points: The url argument in browse.js allows the agent to pull data from any external web page into its context.
Boundary markers: The instructions do not define clear boundaries or provide warnings to the agent to ignore instructions found within the scraped content.
Capability inventory: The skill allows for the reading of external content which is then returned as text or HTML to the agent's context.
Sanitization: The scraped content is returned to the agent without filtering or sanitization of potential natural language instructions.

podman-browser