The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from web pages via Playwright tools and document.body.innerText to perform 'smell scans' for UI errors. This creates a surface where malicious content on a scanned page could attempt to influence the agent's behavior.
Ingestion points: mcp__plugin_playwright_playwright__browser_navigate, mcp__plugin_playwright_playwright__browser_snapshot, and browser evaluation of document.body.innerText.
Capability inventory: Bash (used for port checking and starting the dev server), Read (accessing project files), and browser automation tools.
Boundary markers: No explicit delimiters or warnings to ignore instructions within the scraped web content are specified.
Sanitization: The skill filters content using a predefined list of 'smell patterns' (e.g., searching for 'undefined' or 'Loading…'), which limits the scope of processed text.
[COMMAND_EXECUTION]: The skill utilizes Bash to probe local network ports and start the development stack (e.g., pnpm dev, npm run dev). While these are standard development workflows, they involve executing shell commands based on the project's configuration.
[DATA_EXFILTRATION]: The skill is instructed to search for and use demo credentials found within project seed files (db/seed.*, fixtures/, scripts/seed.*, etc.) and .env.example to perform authentication checks. While these credentials are used locally to test the application, the ability to read and process these files is a significant permission.

render-sanity