The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill references the use of sensitive credential and token files, specifically gtm-credentials.json and gtm-token.json, to facilitate auditing of GTM containers via the Google API.
[DYNAMIC_EXECUTION]: The skill workflow involves the agent generating JavaScript test scripts (e.g., scripts/test-tracking.js) and executing them using the node environment to perform automated browser testing.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests untrusted data from local files and web pages during its validation process.
Ingestion points: Reads business context from gtm-context.md in the project root; intercepts and logs dataLayer events from web pages at http://localhost:3000 using Playwright.
Boundary markers: No delimiters or instructions are specified to ignore potentially malicious embedded content within the gtm-context.md file.
Capability inventory: Executes locally generated scripts via node; performs network connectivity checks using curl; installs packages via npm.
Sanitization: There is no evidence of sanitization or validation of the content read from gtm-context.md or captured from browser events before they are processed or logged.
[EXTERNAL_DOWNLOADS]: The skill instructs the installation of well-known testing libraries and browser binaries, specifically the playwright package and Chromium via npx.
[COMMAND_EXECUTION]: The skill uses shell commands for environment preparation and validation, including curl to verify local server status and npm for dependency management.

gtm-testing