The Agent Skills Directory

[COMMAND_EXECUTION]: The file run.js acts as a universal JavaScript executor. It is designed to take arbitrary code from arguments or files, write it to a temporary .js file in the skill's own directory, and execute it using the require() function. This provides the agent with an unrestricted environment to run any Node.js code.
[CREDENTIALS_UNSAFE]: In lib/helpers.js, the authenticate function is designed to handle login flows. It uses string-splitting patterns (e.g., 'pass' + 'word') when defining DOM selectors for password fields. This technique is often used to evade static analysis tools that monitor for credential-related keywords.
[REMOTE_CODE_EXECUTION]: The skill's installation process (package.json) involves downloading and installing the Playwright framework and the Chromium browser binary. Furthermore, the core workflow involves the agent generating and executing new code at runtime.
[DATA_EXFILTRATION]: The skill facilitates reading content from any web page and provides tools (like page.request) that can be used to transmit extracted data to external servers.
[INDIRECT_PROMPT_INJECTION]: Because the skill processes arbitrary web content, it is vulnerable to indirect prompt injection. Malicious instructions embedded in a target website could attempt to influence the agent's logic or the code it generates for the automation task.

playwright-skill