The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen with shell=True to execute server commands provided via the --server flag. It also uses subprocess.run to execute the primary automation command. This allows for arbitrary shell command execution based on the inputs provided to the script.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection attacks because it brings untrusted data from external websites into the agent's context.
Ingestion points: Data is ingested through page.content(), page.locator().all(), and console log capture (page.on('console', ...)).
Boundary markers: No delimiters or instructions to ignore embedded commands are used when processing external content.
Capability inventory: The skill possesses powerful capabilities, including shell command execution (via with_server.py) and file system writes (to the outputs/ directory).
Sanitization: There is no evidence of sanitization, filtering, or validation of the data retrieved from external URLs before it is presented to or used by the agent.
[EXTERNAL_DOWNLOADS]: The skill instructions require the installation of the playwright library and the subsequent download of browser binaries using the playwright install chromium command.

browser-use