The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains strings commonly associated with prompt injection and jailbreaking (e.g., 'Ignore previous instructions', 'UNFILTERED GOD MODE'). These are located in 'scripts/eval-runner.ts' and 'references/evals.md' as part of an edge-case generator for testing other AI agents. They are treated as test data and do not target the agent executing this skill.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external site data and agent outputs to perform functional verification and evaluations, which presents an attack surface for indirect prompt injection. * Mandatory Evidence Chain: 1. Ingestion: Untrusted data enters the context via 'scripts/eval-runner.ts' (agent output samples) and 'references/functional.md' (site walking). 2. Boundary markers: The skill uses markdown structure for reports but lacks explicit boundary markers or warnings to the LLM to ignore instructions within the ingested content. 3. Capability inventory: The skill has access to 'bash' and 'run_command' tools and can write files. 4. Sanitization: No significant sanitization or escaping of ingested text is performed before processing. Severity: LOW.
[DYNAMIC_EXECUTION]: The 'e2e-runner.ts' and 'eval-runner.ts' scripts generate Playwright test skeletons and failure reproduction packs. This involves assembling code from predefined templates and writing them to disk. This is a primary function of the skill for reporting and debugging purposes and is not considered a high-risk dynamic code execution vector.

qa-launch