The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions include shell commands to run a local Node.js script (collect-visual-signals.js) and pipe its output to the agent-browser tool. This is the primary mechanism for collecting visual data from the local workbench.
[REMOTE_CODE_EXECUTION]: The skill employs the eval functionality of the agent-browser tool to execute JavaScript within the browser context. The executed code is constructed from a local source file (collect-visual-signals.browser.js) with specific parameters substituted at runtime using JSON stringification, which is a standard and safe pattern for browser automation.
[PROMPT_INJECTION]: The agent reviews content such as text and image descriptions extracted from the web pages being tested. This ingestion of external data is inherent to the visual QA process and represents a theoretical surface for indirect prompt injection.
Ingestion points: Data returned from the browser via the collect-visual-signals.js script (processed in SKILL.md).
Boundary markers: The instructions do not define explicit boundary markers for the tool output, although the data is structured as a JSON-compatible object.
Capability inventory: Access to shell commands (node, agent-browser) and local file writing for artifact storage.
Sanitization: The data collection script includes a truncation helper to limit the size of extracted text strings to 140 characters.

nebula-visual-verification