The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's setup process performs global installations of the @playwright/cli package using npm and suggests installing ffmpeg through system package managers. These tools and registries are well-known and trusted for development environments.
[COMMAND_EXECUTION]: The skill executes various CLI tools including git, gh, ffmpeg, and playwright-cli. It also runs a bundled shell script, verify-assets.sh, which performs git plumbing operations to store and publish visual assets. These actions are aligned with the skill's stated purpose of automating visual verification.
[INDIRECT_PROMPT_INJECTION]: The skill reads and processes untrusted data from the local repository and external sources, which creates a potential surface for indirect prompt injection.
Ingestion points: In SKILL.md, the skill reads project source code, file differences (git diff), and linked issue descriptions to identify which features to verify.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard potential instructions embedded within the ingested code or issue text.
Capability inventory: The skill has access to the Bash tool (allowing for network operations via git and package management via npm) and the Write tool for local filesystem modifications.
Sanitization: No sanitization or validation of the ingested content is described before the agent uses it to derive user entry points and drive UI flows.

verifykit