The Agent Skills Directory

[COMMAND_EXECUTION]: Executes a local Node.js script (scripts/inspect-threejs-canvas.mjs) to perform automated browser QA and canvas pixel verification. This is the intended primary function of the skill and is triggered by the agent during the QA workflow.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted data from the browser target which could theoretically influence agent behavior.
Ingestion points: Browser console logs and window.__THREE_GAME_DIAGNOSTICS__ data captured by the inspection script (referenced in SKILL.md and scripts/inspect-threejs-canvas.mjs).
Boundary markers: None present; the captured console and diagnostic data are integrated directly into the final QA report.
Capability inventory: Subprocess execution for running the inspection script, local file writing for saving artifacts/screenshots, and network access through the automated browser instance.
Sanitization: No explicit sanitization or filtering of captured browser logs is performed before they are presented to the agent for analysis.
[DATA_EXFILTRATION]: Captures screenshots and generates JSON reports which are stored in a local artifacts/ directory for user review. No unauthorized network exfiltration was detected.
[EXTERNAL_DOWNLOADS]: Utilizes standard, well-known Node.js packages (@playwright/test, pngjs) for its core functionality. It does not perform any unverified remote code execution.

threejs-qa-release