playwright-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly opens arbitrary web pages (e.g., playwright-cli open <url> and playwright-cli tab-new [url]) and captures/interprets page content via snapshot, eval, and run-code, so it ingests untrusted third-party web content that the agent will read and act on, enabling indirect prompt injection.