The Agent Skills Directory

[PROMPT_INJECTION]: The skill employs a high-stakes social engineering narrative to ensure the agent complies with its workflow over its own safety guidelines. It explicitly claims that deviating from the workflow will "directly harm the user" and lead to the user "losing his job," framing any deviation as a "serious failure of duty." This narrative is designed to bypass the agent's safety filters and professional boundaries.\n- [COMMAND_EXECUTION]: The workflow requires the agent to execute shell commands found in an external task file (.tasks/task.md). In Phase 7, the agent is directed to "run the exact completed command" found in the task file. This represents a significant security risk if the task file is supplied by an untrusted source.\n- [COMMAND_EXECUTION]: The provided Node.js scripts, playwright-lifecycle.mjs and server-probe.mjs, are designed to execute arbitrary shell commands using spawn with the bash -lc flag. These scripts allow the agent to run commands provided as string arguments, which can be misused to execute malicious shell commands on the host environment.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its ingestion of untrusted external data.\n
Ingestion points: .tasks/task.md and .tasks/files/ are read and processed during Phase 1 research.\n
Boundary markers: No explicit boundary markers or delimiters are used when processing the content of these files.\n
Capability inventory: The skill can write to the filesystem and execute arbitrary shell commands (Phase 7).\n
Sanitization: No sanitization is performed on the commands or instructions extracted from the external task files.

task-workflow-new