The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from GitHub PR descriptions which is an untrusted external source. A malicious PR author could attempt to inject instructions into the spec block.
Ingestion points: The run operation in rules/runner.md extracts spec content from the PR body.
Boundary markers: The skill uses  markers to delimit the spec content, which reduces but does not eliminate injection risk.
Capability inventory: The extracted content is passed to aw-tester or aw-tester-chrome for execution via Playwright, providing a path from external text to browser actions.
Sanitization: The skill extracts content between specific markers but does not perform additional validation or sanitization before dispatching to the runner agents.
[COMMAND_EXECUTION]: The skill uses several shell commands for its core functionality as a developer tool.
Evidence: Calls git, gh, node, and jq via the Bash tool as defined in the allowed-tools section of SKILL.md.
Specific usage: scripts/is-ui-diff.mjs executes git diff to determine changed files.
[EXTERNAL_DOWNLOADS]: The skill fetches data from external services to resolve preview URLs.
Evidence: rules/preview-url-resolution.md describes using gh api to fetch deployment information from GitHub and scanning PR comments for URLs from services like Vercel, Netlify, and Cloudflare.
Trusted sources: These are well-known and established technology services, and the resolution process includes reachability checks.

ui-verify