The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute local Node.js scripts located in the scripts/ directory (inventory.js, happy-path.js, and reporter.js). These scripts are used to perform element inventory, execute happy-path and negative test flows, and generate final reports.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the @playwright/test package as specified in scripts/package.json. This is an official, well-known browser automation library maintained by Microsoft.
[DATA_EXPOSURE]: The browser automation scripts (inventory.js and happy-path.js) are designed to accept authentication credentials via --auth-cookie and --auth-token arguments. These credentials are used locally to set the browser context for testing authenticated application states and are not transmitted to any third-party services.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes PRD documents and external web page content to derive test scenarios, which represents a potential attack surface for indirect prompt injection.
Ingestion points: PRD/user story documents in Mode 1 (references/mode-predev.md) and HTML/text content from URLs in Mode 2 (scripts/inventory.js).
Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions when processing external text content.
Capability inventory: The skill has the ability to execute shell commands via Bash and write files via Write.
Sanitization: No explicit sanitization or filtering of the ingested external content is mentioned before it is processed by the agent.

qa-explorer