The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The run.js script acts as a dynamic execution engine. It reads code from command-line arguments, files, or standard input, writes it to a temporary file in the skill's directory, and then executes it using Node.js's require() function. This allows for the execution of arbitrary JavaScript code with the same privileges as the agent.
[COMMAND_EXECUTION]: The run.js file uses execSync from the child_process module to run shell commands such as npm install and npx playwright install chromium. While these are used for setup, the capability to execute shell commands programmatically is a high-privilege operation.
[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves the agent generating custom Playwright automation scripts based on natural language descriptions from the user.
Ingestion points: User-provided descriptions of automation tasks in SKILL.md.
Boundary markers: The skill lacks instructions to sanitize or validate the generated code, nor does it provide delimiters or warnings to ignore embedded instructions within the data being automated (e.g., website content).
Capability inventory: The generated code has access to the full Playwright API (network requests, file system access via file://), the fs module, and child_process through the run.js wrapper.
Sanitization: No sanitization or validation of the generated code is performed before execution.
[EXTERNAL_DOWNLOADS]: The skill automatically downloads and installs the playwright package and the Chromium browser binary from external sources via npm and npx during the setup phase in run.js and package.json.

playwright-skill