The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (HIGH): The script scripts/start-server.sh executes npx @playwright/mcp@latest. This downloads and runs a package from the public npm registry at runtime without version pinning, which is vulnerable to supply chain attacks.
[REMOTE_CODE_EXECUTION] (HIGH): The use of npx to fetch and immediately execute @latest code constitutes unverified remote code execution.
[DYNAMIC_EXECUTION] (MEDIUM): The skill exposes browser_run_code and browser_evaluate tools in SKILL.md. These allow the execution of arbitrary JavaScript within the browser context, which is a powerful and potentially dangerous capability if exploited.
[INDIRECT_PROMPT_INJECTION] (LOW):
Ingestion points: Web content ingested via browser_snapshot in SKILL.md.
Boundary markers: None. There are no instructions to the agent to ignore instructions embedded in the web pages it browses.
Capability inventory: Arbitrary JS execution (browser_run_code), form filling (browser_fill_form), and navigation (browser_navigate) as seen in SKILL.md.
Sanitization: None. The skill does not appear to sanitize or filter content retrieved from the web before the agent processes it.
[COMMAND_EXECUTION] (LOW): The skill relies on shell scripts (scripts/start-server.sh, scripts/stop-server.sh) to manage background processes and uses pgrep and pkill to manage the lifecycle of the MCP server.

browsing-with-playwright