The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and installs agent-browser from the vercel-labs organization and playwright-cli from the microsoft organization to support automated evidence collection. These tools are sourced from well-known and trusted providers.
[COMMAND_EXECUTION]: The skill uses scripts/run-capture-command.mjs to execute shell commands such as pnpm test, npm run dev, and curl to exercise application features and capture output. It implements security best practices by using spawn with shell: false to mitigate command injection risks.
[DYNAMIC_EXECUTION]: The run-capture-command.mjs script performs runtime execution of commands constructed from input parameters to facilitate flexible UAT workflows.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources like pull request descriptions, tickets, and code diffs to determine the scope of testing. 1. Ingestion points: SKILL.md (Workflow Step 1) and references/native-electron-playbook.md (Adversarial Review) specify reading PR descriptions, tickets, and diffs. 2. Boundary markers: No explicit delimiters are present to isolate external data within the prompt. 3. Capability inventory: Includes subprocess execution via run-capture-command.mjs and network/browser automation via agent-browser and playwright. 4. Sanitization: No sanitization or validation of external ticket/PR content is observed.

user-acceptance