The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/render-report.py invokes ffmpeg via subprocess.run to convert Playwright video recordings into compatible formats. The utility is called with a list of arguments, and the file paths are validated to ensure they are relative and confined to the temporary run directory, preventing shell injection and path traversal.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of browser binaries through the npx playwright install command. This is a standard procedure for the well-known Playwright testing framework and is directed towards the agent for user-authorized setup.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from QA markdown lists and browser runtime logs, which constitutes an indirect prompt injection surface. It mitigates this risk through a mandatory evidence chain: it validates all processed data against a formal schema (assets/report.schema.json), sanitizes HTML output using character escaping in both the Python renderer and the JavaScript template, and restricts file operations to isolated temporary directories.
[PERSISTENCE]: The skill maintains a repository-to-checklist mapping in ~/.product-engineering/memories.md. This functions as a local configuration store for the toolset and does not include any mechanisms for unauthorized code execution or system persistence.

pe-verify