The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it ingests untrusted data from an external or local application and uses it to guide subsequent agent actions.
Ingestion points: Data enters the agent context via the browser_snapshot and browser_tabs tools which read the content and structure of the application at the target URL (SKILL.md).
Boundary markers: No specific delimiters or instructions to ignore embedded prompts in the application content are present.
Capability inventory: The skill possesses significant capabilities including browser automation (browser_click, browser_type, browser_navigate), screenshot capture, and file writing to the showcase/assets/ directory (SKILL.md).
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the browser before it is used to map features or perform walkthrough steps.
[COMMAND_EXECUTION]: The skill mentions starting a development server if needed. While it requires user approval, the execution of arbitrary local servers based on the application's configuration carries a baseline risk associated with standard development workflows (SKILL.md).

product-showcase