The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill is designed to ingest and process untrusted data from external websites.
Ingestion points: playwright-cli open and playwright-cli snapshot (references/component-exploration.md).
Boundary markers: None identified; the agent is instructed to identify interactive elements directly from the accessibility tree output.
Capability inventory: Extensive capabilities including click, fill, and eval (JavaScript execution).
Sanitization: None mentioned.
Risk: A malicious webpage could contain hidden text or metadata designed to hijack the agent's logic, leading it to execute unauthorized commands or exfiltrate data.
Remote Code Execution (HIGH): The playwright-cli eval command (references/component-exploration.md) allows for the execution of arbitrary JavaScript code within the context of the browser. This provides an attacker-controlled webpage a path to execute logic via the agent, potentially accessing localStorage, session cookies, or performing actions on behalf of a logged-in user.
Data Exfiltration (MEDIUM): The skill provides tools for monitoring internal application state.
Evidence: playwright-cli network and playwright-cli console (references/component-exploration.md) can expose sensitive data such as API keys in request headers, JWTs, and internal system logs to the agent's output context.
Command Execution (HIGH): The skill relies on an external utility playwright-cli. While the tool's source is not explicitly provided, it grants the agent broad power to interact with the host's network and file system (via screenshots and potential downloads).

e2e