The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (HIGH): The core logic in run.js reads arbitrary input from command-line arguments or stdin and executes it using require(). In an AI agent context, this is a direct path to Remote Code Execution if the agent is tricked into passing malicious code instructions to the skill.\n- [COMMAND_EXECUTION] (MEDIUM): The installPlaywright function uses execSync to perform shell command execution. While intended for environment setup (npm install), this is a high-privilege operation that increases the skill's attack surface.\n- [DATA_EXFILTRATION] (MEDIUM): Because the skill executes code with full Node.js privileges, any script it runs can access sensitive local files (e.g., ~/.ssh/id_rsa, .env) and transmit them to external servers via the network.\n- [PROMPT_INJECTION] (LOW): The skill is highly vulnerable to Indirect Prompt Injection because it provides a high-privilege execution environment for data ingested from untrusted external sources (web pages).\n
Ingestion points: getCodeToExecute() in run.js reads raw input from arguments and stdin.\n
Boundary markers: None; the input is wrapped in a template and executed directly.\n
Capability inventory: Full filesystem access (fs), network access, and shell execution (execSync).\n
Sanitization: No validation or sanitization is performed on the code before it is written to a temporary file and executed.

playwright-skill