The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation describes installing the playwright-core package from the official npm registry. This is a standard dependency for the skill's stated screenshot functionality.
[COMMAND_EXECUTION]: The skill utilizes local shell scripts and standard system tools such as curl, openssl, and python3 to facilitate file uploads and interact with platform APIs.
[DATA_EXFILTRATION]: Image data is uploaded to Cloudinary, and pull request information is transmitted to GitHub or GitLab. These operations are core features of the skill and involve well-known services.
[PROMPT_INJECTION]: The skill processes external URLs (e.g., from PR comments) to visit and screenshot with Playwright, which constitutes an ingestion point for untrusted data.
Ingestion points: Deployed preview URLs or localhost targets accessed via Playwright in SKILL.md.
Boundary markers: None present for the content of screenshotted pages.
Capability inventory: Network access via curl, file system interaction via Playwright screenshots, and PR description updates via platform APIs in SKILL.md and scripts/upload-evidence.sh.
Sanitization: Employs jq for constructing API payloads in shell commands to prevent injection into API requests.

gather-evidence