The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to discover and run commands found in the repository's documentation to start the application ("Read docs/agents/project.md for Run locally (dev). Start the frontend... if absent, discover them, start the app"). This allows for the execution of arbitrary shell commands provided by a potentially untrusted repository.
[DATA_EXFILTRATION]: The instructions advise the agent to capture a reusable signed-in state (e.g., a Playwright storageState) and save it to docs/agents/project.md, which the skill later instructs the agent to commit to the repository ("capture a reusable signed-in state (e.g. a saved storageState) rather than logging in by hand... WRITE them into project.md... Commit the specs"). Storing and committing session tokens or cookies to source control is a dangerous practice that can lead to credential theft.
[DYNAMIC_EXECUTION]: The skill dynamically generates Playwright test scripts and executes them against a browser ("Turn each checklist flow into a spec... Run the specs headless on Chromium"). This runtime generation and execution of code increases the risk profile.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted documentation and configuration files from the repository to guide its actions.
Ingestion points: Reads docs/agents/project.md, playwright.config.*, docs/standards/ui.md, and docs/standards/accessibility.md from the repository files.
Boundary markers: None identified; instructions do not advise the agent to ignore or delimit embedded commands in these files.
Capability inventory: Shell command execution (starting apps, npm installs, running playwright), file system writes (writing specs, updating project.md), and browser automation capabilities.
Sanitization: No input validation or sanitization of content read from the repository is performed before use in commands or specs.

validate-ui