The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from GitHub pull request descriptions.
Ingestion points: The skill reads the PR body using the gh pr view command as described in rules/runner.md.
Boundary markers: It uses  and  HTML comment markers to isolate the spec content.
Capability inventory: The skill can write files, execute GitHub/Git commands, and dispatch the aw-tester sub-agent via Task().
Sanitization: While it extracts content based on markers, it performs no validation or sanitization of the verification steps (WHEN/THEN grammar) before they are executed by the sub-agent.
[DYNAMIC_EXECUTION]: The skill dynamically assembles executable spec and configuration files at runtime.
Evidence: rules/runner.md (Step 3) describes materializing specs.md and aw-target.yml under an ephemeral directory (.agent/{branch}/.preview-spec/) using templates and data fetched from the PR.
Risk: These files define the logic and environment for the subsequent automated browser testing session.
[COMMAND_EXECUTION]: The skill utilizes several CLI tools to interact with the repository and external APIs.
Evidence: The allowed-tools section in SKILL.md includes gh, git, and jq, which are used to resolve deployment URLs and manage PR content.

preview-spec