The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions direct the agent to collect user passwords and write them into a temporary JavaScript file (screenshot-script.mjs). Storing credentials in plaintext on disk, even briefly, creates a risk of exposure if the file is accessed before deletion or if deletion fails.
[DYNAMIC_EXECUTION]: The skill generates a custom JavaScript file at runtime and executes it using the node command. This technique of assembling executable code from templates and executing it increases the attack surface of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill populates a JavaScript template with user-supplied data (such as URLs, emails, and passwords) without performing sanitization. This creates a vulnerability where a specifically crafted input could break out of the string literals and execute arbitrary code within the context of the generated script.
Ingestion points: User-provided application URL, email, and password collected in Step 2, and route names/selectors discovered during the codebase analysis in Step 3.
Boundary markers: None identified. The script template uses direct placeholder replacement (e.g., const BASE_URL = '[APP_URL]';).
Capability inventory: Execution of scripts via node, file system access for reading source code and writing screenshots, and network access via the Playwright browser.
Sanitization: No evidence of input validation, filtering, or character escaping for the values interpolated into the script.
[COMMAND_EXECUTION]: The skill executes shell commands to check for Playwright installations (npx playwright, npm ls), create directories (mkdir), and execute the generated Node.js script.

screenshots