The Agent Skills Directory

[DATA_EXFILTRATION]: The skill attempts to read sensitive environment configuration files, specifically .env, .env.local, and .env.development. While the intended purpose is to identify the application's PORT, these files frequently contain sensitive credentials and API keys. Accessing them represents a data exposure risk.
[COMMAND_EXECUTION]: The skill executes several shell commands to manage the testing lifecycle, including lsof for port detection and git/gh for change detection. Crucially, it may execute local project scripts such as bin/dev, bin/rails, or npm run dev to start a development server in the background.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it processes untrusted data from external sources (GitHub PR file lists and Git diffs). Maliciously named files or branch names could potentially manipulate the mapping of files to routes or influence command arguments.
Ingestion points: Data enters the skill via gh pr view output and git diff file lists (SKILL.md, steps 3 and 4).
Boundary markers: No specific delimiters or instructions are used to ignore embedded prompts within the file paths or PR metadata.
Capability inventory: The skill possesses significant capabilities, including executing local scripts (bin/dev), running shell commands (grep, lsof), and controlling a browser via agent-browser.
Sanitization: There is no evidence of path validation or input sanitization before using file lists to determine testing routes or passing parameters to the CLI.

ce-test-browser