The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted inputs from the user and reads local source code without proper boundary markers or sanitization.
Ingestion points: Untrusted data enters the context through the $ARGUMENTS variable and by reading component source code in SKILL.md (Steps 1 and 2).
Boundary markers: The instructions do not define delimiters or warnings to ignore embedded instructions within the user story or the source code being analyzed.
Capability inventory: The skill has the capability to write files and execute shell commands via npx playwright test (Step 7).
Sanitization: There is no explicit requirement to sanitize or validate the external content before it is used to generate executable test scripts.
[COMMAND_EXECUTION]: The skill workflow involves executing shell commands which could be manipulated by the generated content.
Evidence: Step 7 in SKILL.md instructs the agent to execute npx playwright test <generated-file> --reporter=list to verify the tests.
[DYNAMIC_EXECUTION]: The skill generates script files at runtime from templates and external data, then immediately proceeds to execute them.
Evidence: Steps 4 and 7 in SKILL.md describe a process where TypeScript or JavaScript spec files are generated based on interpolated data and subsequently run using the Playwright test runner.

generate