The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains hardcoded credentials (browser-test@langwatch.ai / BrowserTest123!) in SKILL.md and HOW_TO.md. While labeled as "Standard Test Credentials" for local development environments, hardcoding any credentials in instruction files is a violation of security best practices.
[DATA_EXFILTRATION]: Application screenshots are uploaded to an external, unauthenticated public hosting service (https://img402.dev/api/free) via curl. As this is not a whitelisted or well-known secure service, it poses a significant risk of exposing sensitive data captured from the application UI.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8).
Ingestion points: Reads user arguments and external specs/*.feature files to define test scenarios.
Boundary markers: Absent; instructions from external files are directly interpolated into the sub-agent's mission prompt without delimiters or instructions to ignore embedded commands.
Capability inventory: The sub-agent has access to Playwright MCP tools and Bash; the orchestrator has access to gh api (GitHub) and curl.
Sanitization: No validation or escaping is performed on the content of the feature files before processing.
[COMMAND_EXECUTION]: The skill executes local repository scripts (scripts/dev-up.sh, scripts/dev-down.sh) and uses system binaries like curl and the GitHub CLI (gh api) to update pull requests. These tools provide a powerful surface for potential abuse if the instructions are manipulated via injected feature files.

browser-test