The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8).
Ingestion points: The agent reads external instructions from markdown files in a user-provided repository path, specifically testcase/browser-regression-cases.md and testcase/browser-regression-guide.md.
Boundary markers: None; the instructions explicitly tell the agent to treat these files as the "execution source of truth" without implementing delimiters or warnings to ignore embedded malicious instructions.
Capability inventory: The skill has the capability to read local files (testcases and auth files), execute shell commands via agent-browser, and perform arbitrary network operations through the browser tool.
Sanitization: No sanitization or validation of the testcase content is performed before the agent interprets and executes the described steps.
[COMMAND_EXECUTION]: The skill executes the agent-browser command-line tool using shell commands. It passes dynamically constructed arguments, including session names and target URLs, which could be manipulated if the input sources are compromised.
[CREDENTIALS_UNSAFE]: The skill is designed to ingest and process sensitive credentials (usernames, passwords, and authentication tokens) from a local auth.json file. While the skill recommends using local files for secret management, the combination of credential access and the indirect prompt injection surface creates a risk of data exfiltration.

agent-browser-test-from-prd