The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a universal executor (run.js) that takes Javascript code, wraps it in a template, writes it to a temporary file, and executes it using Node.js require(). This is the core functionality allowing the agent to perform complex browser interactions.
[EXTERNAL_DOWNLOADS]: The skill relies on the playwright package and requires a setup step (npm run setup) that downloads browser binaries (Chromium) from Playwright's official sources. These are well-known and trusted services.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it ingests untrusted data from external websites into the agent's context.
Ingestion points: Website content is read using Playwright locators and helper functions like extractTexts and extractTableData in lib/helpers.js.
Boundary markers: The skill does not implement specific boundary markers or instructions for the agent to ignore embedded commands in the web content.
Capability inventory: The execution environment has access to the full Node.js API via the run.js wrapper, including filesystem access and the ability to spawn subprocesses.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from web pages before it is processed by the agent.
[DATA_EXPOSURE]: The skill supports passing custom HTTP headers via environment variables (PW_HEADER_NAME, PW_HEADER_VALUE, PW_EXTRA_HEADERS). While a legitimate feature for testing authenticated or restricted sites, it could be misused to include sensitive tokens in requests to external domains if the agent is not carefully instructed.

playwright-skill