The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The instruction set in SKILL.md (Step 1, Command 3) requires the agent to run ./qa-playwright-capture.sh. Since this script is not bundled with the skill, the agent is directed to execute code from the project's working directory without any integrity or content verification. This allows for arbitrary code execution if the analyzed project contains a malicious file with that name.
[COMMAND_EXECUTION]: The skill uses shell commands like ls, grep, and cat as part of its mandatory process. While these specific utilities are standard, the reliance on shell execution for environment discovery increases the skill's attack surface.
[PROMPT_INJECTION]: The skill ingests data from public/qa-screenshots/test-results.json and uses it to drive its analysis and report generation, creating a surface for indirect prompt injection.
Ingestion points: Reading content via cat public/qa-screenshots/test-results.json as specified in SKILL.md.
Boundary markers: None. The agent is instructed to treat the file content as factual evidence for its report.
Capability inventory: The agent has shell access (ls, grep, ./qa-playwright-capture.sh) and file system access.
Sanitization: None. Maliciously crafted data in the JSON file could influence the agent's logic or trigger unintended behavior.

agency-reality-checker