The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface by processing external web content. * Ingestion points: The skill ingests data from external web pages via page.goto() and locators such as page.getByRole(), page.getByLabel(), and page.getByText() across all example files. * Boundary markers: There are no explicit instructions or code patterns to delimit or treat ingested web content as untrusted data within the provided examples. * Capability inventory: The skill possesses significant capabilities including network operations (page.route() in SKILL.md and examples/api-mocking.md, fetch() in examples/advanced-features.md, and request.post() in examples/fixtures.md), file system writes (toHaveScreenshot() in examples/visual-testing.md), and shell command execution (npx playwright test, npm run dev in playwright.config.ts). * Sanitization: The provided patterns do not implement sanitization or filtering of the content retrieved from the browser before using it in assertions or network requests.
[COMMAND_EXECUTION]: The skill references the execution of shell commands such as npx playwright test and npm run dev (in playwright.config.ts) as part of the standard testing workflow. These are executed within the user's environment to run the test suite and the application under test.
[EXTERNAL_DOWNLOADS]: The skill provides examples of network requests to external or local APIs for data seeding and profile fetching. Specifically, examples/advanced-features.md uses fetch() to interact with ${API}/api/test/users, and examples/fixtures.md uses request.post() for database seeding. These operations are scoped to the testing environment and are standard for the primary purpose of the skill.

web-testing-playwright-e2e