The Agent Skills Directory

[DATA_EXPOSURE_&_EXFILTRATION]: The skill correctly instructs users to manage credentials using environment variables (BROWSERSTACK_USERNAME, BROWSERSTACK_ACCESS_KEY). It does not hardcode any real secrets or exfiltrate them to unauthorized third parties; they are used strictly for authenticating with the cdp.browserstack.com WebSocket endpoint and within the local command execution context.
[COMMAND_EXECUTION]: The skill uses npx playwright test to execute tests. This is the expected and standard behavior for a Playwright integration tool. The commands are local and focused on the testing workflow.
[EXTERNAL_DOWNLOADS]: The skill suggests installing browserstack-local via npm. This is a well-known, official package from the vendor required for local tunnel testing and follows standard development practices.
[INDIRECT_PROMPT_INJECTION]: The skill ingests test results and session logs via MCP tools. While this constitutes an attack surface, the risk is minimal as the data is primarily used for generating summary tables and monitoring execution, with no evidence of unsafe interpolation into execution-critical logic.

browserstack