The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted data from external websites via the Chrome DevTools MCP. Specifically, the tester, reproducer, and analyzer roles read DOM snapshots, console messages, and network request details. This untrusted data is then used by the analyzer to perform root cause analysis and by the fixer to implement code changes. A malicious website could contain specially crafted content designed to influence the agent's logic or trick it into making harmful modifications to the local codebase.
Ingestion points: mcp__chrome-devtools__take_snapshot, list_console_messages, and list_network_requests tools used in roles/reproducer/role.md and roles/tester/role.md.
Boundary markers: None explicitly defined to distinguish untrusted browser data from agent instructions.
Capability inventory: The skill possesses the Edit tool for local file modification and the Agent tool for spawning workers.
Sanitization: No explicit sanitization or validation of strings retrieved from the browser context is performed before processing.
[COMMAND_EXECUTION]: Dynamic Agent Spawning. The coordinator role in SKILL.md uses the Agent tool to spawn background workers using a template. This template dynamically interpolates variables such as skill_root, role_spec, and requirement. While this is part of the intended multi-agent coordination, spawning agents with dynamically constructed prompts is a high-privilege operation.
[COMMAND_EXECUTION]: Shell Command Execution. The coordinator role executes Bash({ command: "pwd" }) to resolve the absolute path of the project root. While used for legitimate path resolution to ensure worker roles can find their specifications, the use of a shell tool is a notable capability.

team-frontend-debug