The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically generates JavaScript/TypeScript scripts at runtime for two primary purposes: authentication flows and adversarial validation probes. These scripts are rendered from templates defined in rules/auth.md and rules/adversarial-validation.md, written to ephemeral files under .agent/storybook/, and then executed using npx playwright test. This pattern involves generating executable code from configuration and external inputs.
[COMMAND_EXECUTION]: The skill performs extensive shell command execution, including background process management using nohup, process termination via kill, and interaction with system-level credential managers such as the macOS security utility, Linux secret-tool, and Windows DPAPI via PowerShell. It also executes arbitrary scripts defined in the project's package.json (e.g., Storybook start scripts).
[DATA_EXFILTRATION]: The skill manages highly sensitive authentication data. While it correctly implements best practices by utilizing OS-level keychains for passwords and requiring storageState.json (which contains session cookies and tokens) to be gitignored under .agent/storybook/.auth/, the handling of these session tokens within the agent's workspace presents a risk if not properly constrained. The auth flow fallback to environment variables (STORYBOOK_AUTH_<PROFILE>_PASSWORD) is also a potential exposure vector if environment logs are captured.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it ingests untrusted data from the target repository's package.json and component source code.
Ingestion points: Extracts component names, props, variants, and metadata from production .tsx files and configuration from package.json and auth.config.json.
Boundary markers: No explicit boundary markers or instruction-ignoring delimiters are specified for the processing of inferred component metadata.
Capability inventory: The skill possesses powerful capabilities including arbitrary shell execution (npm, npx), system credential access, and file writing across the repository.
Sanitization: There is no documented sanitization of component props or metadata before they are interpolated into the dynamically generated test scripts.
[EXTERNAL_DOWNLOADS]: The skill triggers external downloads of browser binaries and testing infrastructure via npx playwright install. These downloads originate from well-known and trusted sources (Microsoft/Playwright) and are documented here for transparency, though they do not contribute to a high severity verdict under trusted source rules.

storybook