The Agent Skills Directory

Dynamic Module Resolution: The gallery implementation uses dynamic imports and import.meta.glob to resolve and execute component story files at runtime based on identifiers provided during tests.
Concern: Dynamic loading from computed paths is a security consideration as it involves resolving code execution paths during the application's runtime.
Evidence: The resolve function in references/gallery-spec.md dynamically accesses and invokes functions from the stories object based on variable paths.
Indirect Prompt Injection Surface: The skill provides an interface (window.mount) that accepts story identifiers and component properties to render scenarios in the browser.
Concern: This creates a surface where data provided to the testing fixture influences the rendered environment, which could be exploited if untrusted data is passed as props.
Evidence: The mount fixture described in SKILL.md and references/gallery-spec.md allows passing arbitrary serializable props to the components under test.
Ingestion points: The window.mount(params) function exposed in the gallery page.
Boundary markers: None identified.
Capability inventory: Execution is limited to rendering React/Vue components within the browser's sandbox on a local development server.
Sanitization: No explicit sanitization of props or story identifiers is documented.

playwright-component-testing