The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The run.js script implements a dynamic execution pattern where JavaScript code provided as input is wrapped in a template, written to a timestamped temporary file within the skill directory, and then executed using the Node.js require() function.
[COMMAND_EXECUTION]: The skill's setup process and execution wrapper utilize child_process.execSync to install dependencies and manage the Playwright environment, allowing for arbitrary system command execution during the initialization phase.
[DATA_EXFILTRATION]: The lib/helpers.js utility includes a detectDevServers function that performs automated local network probing by attempting HTTP connections to a predefined list of common development ports on localhost.
[PROMPT_INJECTION]: The skill exhibits a high vulnerability surface for indirect prompt injection. Because it is designed to navigate to arbitrary URLs and extract page content (via extractTexts, extractTableData, etc.), the agent could ingest and follow malicious instructions embedded in third-party websites.
Ingestion points: page.goto, extractTexts, extractTableData, and page.evaluate calls in lib/helpers.js.
Boundary markers: None identified in the script logic to distinguish between trusted instructions and untrusted web content.
Capability inventory: Subprocess execution via execSync in run.js, file system writing in run.js and lib/helpers.js, and full network access via the Playwright browser.
Sanitization: No evidence of input sanitization or instruction filtering for content retrieved from external URLs.

playwright-skill