The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses cmux_split to execute shell commands such as npm run dev and docker compose to start the application environment. It also uses npx for running lighthouse and axe-cli audits.
[EXTERNAL_DOWNLOADS]: Fetches the axe-core accessibility library from cdnjs.cloudflare.com, which is a well-known and trusted content delivery network.
[REMOTE_CODE_EXECUTION]: Uses npx to download and execute axe-cli and lighthouse from the npm registry, which is a standard package management service.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from web applications. Ingestion points: Browser snapshots, DOM trees, console logs, and JavaScript error messages retrieved via cmux_browser. Boundary markers: No explicit delimiters are used to wrap or sanitize content extracted from the web pages being tested. Capability inventory: The skill has access to shell execution (cmux_split) and arbitrary JavaScript execution in the browser (cmux_browser eval). Sanitization: No validation or filtering is applied to the content retrieved from external URLs before the agent processes it.

qa-testing