The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains hardcoded default development credentials (admin@odl.local / admin) in both the SKILL.md instructions and the get-auth-context.py script. While documented for a local development stack, hardcoding credentials is a significant security risk if used in environments where these defaults have not been changed.
[DATA_EXFILTRATION]: The skill uses grep to search for base URLs and ports within .env and .env.local files. These files often contain highly sensitive production secrets, and instructing an agent to parse them increases the risk of accidental exposure of credentials or other sensitive environment variables.
[COMMAND_EXECUTION]: The skill executes various shell commands including grep, curl, and shot-scraper. These commands utilize variables like login_url and JS snippets derived from user input and repository context, which could potentially lead to command injection if the inputs are malicious.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. In Step 2, it ingests data from pull request descriptions, titles, and diff summaries. This untrusted data is then used to generate a screenshot plan and translate natural language instructions into JavaScript.
[REMOTE_CODE_EXECUTION]: The skill demonstrates risky dynamic execution patterns by generating JavaScript strings based on the pull request context and executing them in a browser session via shot-scraper --javascript.
Ingestion points: PR description, PR title, and file diffs in Step 2.
Boundary markers: No boundary markers or 'ignore' instructions are used when processing the PR data.
Capability inventory: Shell execution (via shot-scraper) and browser-level JavaScript execution (page.evaluate equivalent).
Sanitization: No sanitization or validation is performed on the pull request content before it is used to generate executable code.

screenshot-pr