The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates interaction with an external web application at https://dev.new.expensify.com:8082/ using Playwright automation tools, creating an attack surface where untrusted data from the web page could influence agent behavior.
Ingestion points: The agent is directed to navigate to and inspect the content of https://dev.new.expensify.com:8082/ (SKILL.md).
Boundary markers: Absent. The instructions do not provide delimiters or warnings to help the agent distinguish between its system instructions and potentially malicious content embedded in the web application's UI.
Capability inventory: The agent is authorized to use Playwright MCP tools to "inspect, click, type, and navigate" (SKILL.md), which allows it to take actions based on what it reads from the page.
Sanitization: Absent. No filtering or validation mechanisms are defined for the data retrieved via Playwright before it is processed by the agent.
[COMMAND_EXECUTION]: The skill contains instructions to execute local shell commands to verify the state of the development environment.
Evidence: Instructions to run ps aux | grep "webpack" | grep -v grep to check for the dev server and a recommendation to run npm run web to start the application (SKILL.md).

playwright-app-testing