The Agent Skills Directory

[DATA_EXPOSURE]: The diagnostic script in references/diagnostic-decoder.md uses grep to access and parse the .env file. Accessing environment files is a high-severity finding because these files typically store sensitive credentials, API keys, and private configuration data.
[CREDENTIALS_UNSAFE]: In references/login-and-test-data.md, the skill describes a multi-account fallback pattern that programmatically retrieves and uses usernames and passwords from a project's credential store. This automated management of authentication secrets increases the risk of credential leaking through logs or session state files like local-auth.json.
[COMMAND_EXECUTION]: The skill provides multiple functional bash scripts designed for the agent to run. These include DNS probing using the host command and complex login loops that combine file reading, string manipulation, and conditional logic (references/diagnostic-decoder.md, references/login-and-test-data.md).
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill utilizes playwright-cli to ingest untrusted content from external web applications via snapshots and screenshots (SKILL.md).
Boundary markers: Absent. The skill does not define specific delimiters or instructions to prevent the agent from following instructions potentially embedded in the DOM of the target website.
Capability inventory: The skill has the ability to execute shell commands and interact with browser sessions, providing a surface for multi-step attacks if the ingested web data is malicious (references/login-and-test-data.md).
Sanitization: There are no documented sanitization or filtering steps for the data retrieved from web pages before it is processed by the agent.

common-web-visual-testing