The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The 'run-code' command (documented in SKILL.md and references/running-code.md) allows the execution of arbitrary JavaScript code via Playwright. Since this runs in a Node.js environment on the host machine, it effectively grants the agent the ability to execute arbitrary code locally.
[DATA_EXFILTRATION]: Multiple commands enable the extraction of sensitive authentication data. 'cookie-list', 'cookie-get', 'localstorage-list', and 'state-save' (documented in references/storage-state.md) can be used to harvest session cookies and authentication tokens from the browser.
[COMMAND_EXECUTION]: The skill facilitates the execution of the 'playwright-cli' tool through shell commands. This allows the agent to perform actions that modify the local filesystem, such as saving screenshots, PDFs, and browser state files.
[EXTERNAL_DOWNLOADS]: The 'open' and 'goto' commands permit the browser to navigate to any external URL, fetching and rendering content from untrusted sources.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its interaction with untrusted web content.
Ingestion points: Data enters the agent's context through 'playwright-cli snapshot', 'playwright-cli eval', and 'playwright-cli run-code' outputs.
Boundary markers: Absent; there are no delimiters or instructions to treat web content as untrusted data.
Capability inventory: Includes arbitrary code execution ('run-code'), local file read/write, and unrestricted network access.
Sanitization: Absent; web content is processed and returned to the agent without filtering or escaping.

playwright-cli