The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes hardcoded shell commands for environment preparation and connectivity verification.
Evidence: The 'Prepare' step uses mkdir -p .qa to create a directory and appends it to .gitignore using grep, printf, and tail (SKILL.md, Step 1).
Evidence: The skill uses curl to check if the target development server is reachable (SKILL.md, Step 1).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, including web pages, console logs, and API responses, which may contain malicious instructions targeting the subagent.
Ingestion points: The subagent reads page snapshots, monitors console messages for errors, and evaluates network response data (SKILL.md, Step 2 and Step 3).
Boundary markers: The prompt template provided to the subagent does not define explicit delimiters or instructions to ignore potential commands embedded within the fetched data.
Capability inventory: The skill has the ability to execute shell commands, perform browser interactions (click, type), and conduct network requests.
Sanitization: The skill includes logic to redact sensitive information such as session tokens, anti-CSRF tokens, and personal data from its reports to prevent accidental data exposure.

browser-qa