The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to install the @playwright/cli package from npm. This package uses the official @playwright scope associated with Microsoft and the Playwright project, yet it is not a documented official package. Recommending a non-official package within a trusted namespace is a primary indicator of a supply chain attack or impersonation risk.
[REMOTE_CODE_EXECUTION]: The run-code and eval commands allow for the execution of arbitrary JavaScript within the browser environment. This provides the agent (or a malicious actor influencing the agent) with unrestricted control over the browser context, including the ability to bypass security controls or perform unauthorized actions.
[DATA_EXFILTRATION]: The skill includes dedicated commands for retrieving sensitive browser data, such as cookies, local storage, session storage, and complete storage states. These items often contain authentication tokens and private user information. When combined with the skill's network capabilities, this presents a significant risk for data exfiltration.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because it is designed to ingest and process content from arbitrary web pages.
Ingestion points: Live web content retrieved via open, goto, and snapshot commands.
Boundary markers: The instructions lack delimiters or warnings to prevent the agent from interpreting page content as instructions.
Capability inventory: The skill possesses powerful capabilities including arbitrary JS execution (run-code), network routing, and file system access.
Sanitization: There is no evidence of sanitization or safety checks performed on the data retrieved from external sources before it is processed by the agent.
[COMMAND_EXECUTION]: The skill requires permission to run several powerful shell commands, including playwright-cli, npm, and npx, which allows for persistent changes to the execution environment via global package installations.
[DATA_EXFILTRATION]: Documentation for the run-code feature includes examples of accessing the system clipboard and capturing full page content, which can be easily exfiltrated to external servers.

playwright-cli