The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The run-code command enables the execution of arbitrary JavaScript/Playwright code strings. This is a powerful feature that can be exploited if the agent is tricked into running malicious scripts.
Evidence: Found in references/running-code.md and SKILL.md.
[DATA_EXFILTRATION]: The skill provides numerous commands to extract sensitive browser information, including cookies, localStorage, and full session states (state-save, cookie-list, localstorage-get). This data can contain authentication tokens and private user information.
Evidence: Found in SKILL.md and references/storage-state.md.
[COMMAND_EXECUTION]: The skill operates by executing commands through a playwright-cli binary via the Bash tool. It also allows for file system operations such as saving screenshots, PDFs, and trace files.
Evidence: Found in SKILL.md command definitions.
[EXTERNAL_DOWNLOADS]: The skill includes commands to install external components, specifically install --skills and install-browser, which download software from remote sources.
Evidence: Found in SKILL.md under the Install section.
[INDIRECT_PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection because it reads and processes untrusted content from the live web.
Ingestion points: Web page content ingested via snapshot, eval, and run-code in SKILL.md.
Boundary markers: Absent. No instructions are provided to the agent to ignore instructions embedded in the web content.
Capability inventory: Subprocess execution via Bash, arbitrary JS execution via run-code, file-write via screenshot/pdf/state-save, and network mocking via route.
Sanitization: Absent. The skill does not appear to sanitize or validate content extracted from browsers before it is returned to the agent context.

playwright-cli