The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary JavaScript/Playwright code using the -e flag and the execute tool. This code runs directly in the user's active browser session. Evidence: playwriter -s 1 -e 'await page.goto("https://example.com")' and the execute tool description in SKILL.md.\n- [REMOTE_CODE_EXECUTION]: Installation instructions require fetching the playwriter package from NPM using npx or npm install -g. These commands download and execute code from a third-party registry without version pinning or integrity checks. Evidence: npm install -g playwriter and npx -y playwriter@latest in SKILL.md.\n- [DATA_EXFILTRATION]: The skill's primary design is to access authenticated browser states, including cookies, sessions, and extensions. It includes specific tools for network request interception and screen recording, which can be used to extract sensitive information from the browser. Evidence: page.on("request", r => state.requests.push(r.url())) and recording.start() examples in SKILL.md.\n- [COMMAND_EXECUTION]: A remote relay server feature allows the browser to be controlled from another machine over a WebSocket connection. Evidence: playwriter serve --token my-secret in SKILL.md.\n- [PROMPT_INJECTION]: The skill ingests untrusted data from external websites, creating a surface for indirect prompt injection.\n
Ingestion points: snapshot({ page }), getPageMarkdown(), and getCleanHTML() in SKILL.md read content from visited websites.\n
Boundary markers: None identified; instructions do not specify delimiters to isolate web content from agent commands.\n
Capability inventory: The skill has access to Bash, Write, and arbitrary browser code execution (playwriter -e).\n
Sanitization: No evidence of sanitization or filtering of the ingested web content before it is processed by the agent.

playwriter