The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill is designed to ingest and process untrusted data from external websites.
Ingestion points: Website content is ingested via browser_navigate and browser_snapshot (SKILL.md).
Boundary markers: None. There are no delimiters or instructions to ignore embedded commands in the processed HTML/text.
Capability inventory: The skill provides powerful side-effect capabilities including browser_click, browser_fill_form, browser_evaluate, browser_run_code, and browser_take_screenshot (SKILL.md).
Sanitization: None. External content is passed directly to the agent's context.
Risk: An attacker-controlled webpage could contain hidden instructions (e.g., in a hidden div) that command the agent to exfiltrate the user's cookies, session data, or page content to a remote server using the provided JS execution tools.
Dynamic Execution (HIGH): The tools browser_evaluate and browser_run_code allow for arbitrary JavaScript execution within the browser context.
Evidence: The browser_run_code tool specifically takes an async (page) => { ... } string and executes it (SKILL.md). This provides a trivial primitive for an injected prompt to perform complex malicious operations like silent data exfiltration via fetch() or automated form submission on sensitive sites.
Unverifiable Dependencies (LOW): The start-server.sh script executes npx @playwright/mcp@latest.
Evidence: npx @playwright/mcp@latest (scripts/start-server.sh).
Trust Status: While 'microsoft' is a trusted organization, using @latest without version pinning is a supply chain risk. However, per [TRUST-SCOPE-RULE], this finding is downgraded to LOW due to the official nature of the Playwright ecosystem.

browsing-with-playwright