The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the $ARGUMENTS variable and reads local codebase files (such as components and existing tests) to generate test scripts. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the data being processed.
Ingestion points: The $ARGUMENTS input field in SKILL.md and the Explore subagent's codebase reading operations in Step 2.
Boundary markers: The instructions lack explicit delimiters or warnings to ignore potentially malicious embedded instructions in the user story or project files.
Capability inventory: The skill has the capability to read and write files and execute shell commands via npx playwright test.
Sanitization: There is no evidence of sanitization or validation of the input before it is used to generate executable code.
[DYNAMIC_EXECUTION]: The skill programmatically generates test scripts in TypeScript or JavaScript and immediately executes them. While this is the primary purpose of the skill, the execution of agent-generated code based on untrusted input presents a risk if the generated code deviates from intended behavior.
[COMMAND_EXECUTION]: The skill executes a shell command npx playwright test using a generated filename as an argument. This provides a vector for command injection if the agent is manipulated into creating a filename or content that escapes the intended command context.

generate