The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill interacts with external, untrusted web content through Playwright automation, creating a surface for indirect prompt injection attacks.
Ingestion points: The skill uses browser_snapshot, browser_console_messages, and browser_evaluate to ingest HTML structure, text content, and logs from arbitrary URLs into the agent's context in SKILL.md.
Boundary markers: The instructions lack explicit delimiters or warnings to the agent to ignore instructions that might be embedded within the processed web content in SKILL.md.
Capability inventory: The agent has access to local shell execution (bash) and extensive browser automation tools (Playwright MCP) in SKILL.md.
Sanitization: Content retrieved from the browser is not sanitized or filtered before analysis in SKILL.md.
[COMMAND_EXECUTION]: The skill executes shell commands (lsof, curl) via bash to detect local servers and validate URL reachability during the discovery phase in SKILL.md.
[DYNAMIC_EXECUTION]: The skill employs dynamic execution techniques in two areas within SKILL.md:
It generates and runs a bash script loop at runtime to scan common ports for active local servers.
It uses browser_evaluate to execute dynamically defined JavaScript snippets within the browser context to perform responsiveness checks and accessibility audits.

app-testing