The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the application codebase (via Glob, Grep, and Read tools) and the live application environment (via Playwright snapshots). If these sources contain malicious instructions designed to influence an LLM, the sub-agents could be affected.
Ingestion points: Application source code files, route definitions, and live DOM content from the target URL.
Boundary markers: The sub-agent prompts define specific roles but do not include explicit instructions to ignore embedded commands within the analyzed code.
Capability inventory: The skill can execute shell commands via playwright-cli and bash, read project files, and write to the filesystem at /workflows/mobile-workflows.md.
Sanitization: No explicit sanitization or filtering of the content read from the codebase or application UI is mentioned before it is passed to the sub-agents.
[COMMAND_EXECUTION]: The skill uses playwright-cli and bash to perform browser automation tasks and manage workflow steps. These commands are executed based on the user-provided URL and the codebase structure. While necessary for the skill's functionality, they represent a powerful execution environment.
[DATA_EXFILTRATION]: The skill manages authentication states by reading and writing to .playwright/profiles.json and associated storage state files. It also prompts the user for credentials (email/password) to facilitate testing auth-gated routes. While this data is intended for use with the target application, handling session cookies and local storage state is a sensitive operation.

mobile-workflow-generator