The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external web applications during the testing process, which could contain malicious instructions designed to influence the agent.
Ingestion points: SKILL.md Phase 4 (Explore) specifies reading page layouts, image tags, interactive elements, form validations, and console output (errors, network requests) from the application under test.
Boundary markers: The instructions lack explicit delimiters or guidance to ignore natural language instructions found within the tested site's content, metadata, or console logs.
Capability inventory: The agent leverages powerful browser automation tools (Playwright, Puppeteer, Cypress) that can perform authenticated actions, fill forms, and navigate complex application states as defined in Phase 2 and Phase 3 of SKILL.md.
Sanitization: No sanitization or validation logic is defined to filter or escape content retrieved from web pages before the agent processes and interprets it.

qa-systematic