The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The screenshots.md file contains hardcoded default credentials (admin@example.com and admin123) for the Bagisto admin login. These are documented as the platform's standard default credentials for a freshly seeded store and are used to automate Playwright screenshot scripts.
[DYNAMIC_EXECUTION]: The publishing.md file contains inline Python scripts executed via shell heredocs to perform validation tasks, such as checking for broken redirect targets and identifying orphaned pages in the documentation structure.
[COMMAND_EXECUTION]: The SKILL.md file includes a shell command that performs a search for documentation repositories across the user's home directory (~), which is a broad file access pattern.
[INDIRECT_PROMPT_INJECTION]: The skill interacts with documentation markdown files which creates an attack surface for indirect prompt injection.
Ingestion points: Documentation source files located in the src/ directory.
Boundary markers: The instructions do not define any delimiters or warnings to prevent the agent from executing instructions that may be embedded in the documentation text.
Capability inventory: The skill has access to file system operations, shell command execution (git, find, grep, npm, php), and dynamic script execution (Python, Playwright).
Sanitization: The skill does not implement any mechanisms to sanitize or filter documentation content before it is processed by the agent.

bagisto-documentation