The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data which could contain malicious instructions meant to influence the agent's routing or subsequent actions.
Ingestion points: The skill explicitly accepts user_request, repo_context, requirements, and failure_output as input artifacts in the YAML frontmatter.
Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" warnings for the agent when processing these external artifacts.
Capability inventory: While the orchestrator itself does not list execution tools, it serves as a gateway to sub-skills (such as core, ci, and playwright-cli) that typically require file system access and command execution capabilities.
Sanitization: There is no evidence of sanitization, validation, or filtering of the content within the input artifacts before they are used to make routing decisions.

playwright-orchestrator