The Agent Skills Directory

[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill requires the playwright Node.js package for browser automation. This is an industry-standard library provided by a well-known service.
[DYNAMIC_EXECUTION]: Automation is achieved by generating Playwright scripts in the /tmp directory which are then executed locally via Node.js. This is the intended functional design for automating the Clarity PPM UI.
[INDIRECT_PROMPT_INJECTION]: The skill interacts with external data by reading the web application's DOM and timesheet grid. This attack surface is mitigated by strict boundary markers requiring the agent to preview data and obtain explicit user consent before any write operations (e.g., submitting or approving). Hour entries are also sanitized via normalization to 0.5h increments.
[PERSISTENCE_MECHANISMS]: The documentation provides instructions for users to manually configure scheduled tasks via cron or Windows Task Scheduler to enable unattended runs. The skill does not automate the creation of these persistence mechanisms.
[SAFE]: The skill explicitly uses the Chrome DevTools Protocol (CDP) to attach to an already-authenticated session on localhost:9222, ensuring no credentials or SSO tokens are processed by the AI.

clarity-timesheet