The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes npx playwright test on files it generates at runtime during the 'Verify' step. This allows for the execution of arbitrary commands if the generated test file is compromised.
[DYNAMIC_EXECUTION]: The skill generates Playwright test scripts by interpolating user-supplied input from $ARGUMENTS into templates. It then proceeds to execute this generated code. This pattern of incorporating untrusted input into executable code that is immediately run is a critical security vulnerability.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted data.
Ingestion points: Untrusted data enters the agent context via the $ARGUMENTS variable in SKILL.md.
Boundary markers: Absent. The instructions do not define any delimiters or safety constraints to distinguish between legitimate user stories and malicious instructions embedded in the input.
Capability inventory: The skill possesses extensive capabilities including file system reads (project source, auth setups), file system writes (tests, fixtures, data), and shell command execution (npx playwright test) as defined in SKILL.md.
Sanitization: Absent. There is no evidence of validation or sanitization of the input provided in $ARGUMENTS before it is used to generate executable code.
[CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to search for and read sensitive files, specifically mentioning auth.setup.ts and storageState configuration. These files commonly contain sensitive information like API keys, session tokens, and cookies, which could be exposed or exfiltrated by maliciously generated tests.

generate