The Agent Skills Directory

[PROMPT_INJECTION]: The instructions use emotional manipulation and high-stakes scenarios (e.g., 'do-or-die situation', 'the user can lose his job if the Agent stops early') to enforce absolute compliance. This technique is typical of prompt injection attacks designed to override an AI's operational guardrails and decision-making by creating artificial urgency or pressure.
[COMMAND_EXECUTION]: The skill includes a Node.js utility, playwright-lifecycle.mjs, which serves as a wrapper for executing arbitrary shell commands via bash -lc. This utility takes command strings derived from the agent's interpretation of the project, providing a direct mechanism for running unvalidated shell commands.
[DATA_EXFILTRATION]: The skill exhibits a significant surface for indirect prompt injection due to its workflow requiring the ingestion of untrusted data from the workspace. 1. Ingestion points: .tasks/task.md, .tasks/domain.md, files in .tasks/files/, and AGENTS.md. 2. Boundary markers: No explicit markers or 'ignore' instructions are defined to separate task data from internal logic. 3. Capability inventory: The agent can execute arbitrary shell commands via the lifecycle helper, modify files across the target repository, and initiate network requests through Playwright scripts. 4. Sanitization: No sanitization or validation logic is applied to the ingested task data before it influences agent actions.

task-workflow-skill