The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents the use of standard command-line tools for the BoxLang ecosystem to execute tests and debug results.
Evidence: Use of ./testbox/run for executing test suites and bxPlaywright show-trace for analyzing test artifacts.
[INDIRECT_PROMPT_INJECTION]: The skill provides an interface for interacting with and extracting data from external web pages, which is an inherent part of browser testing functionality. An agent using this skill could potentially be influenced by instructions hidden within the content of a site being tested.
Ingestion points: External data enters the context via page.visit(), page.locator().text(), and matchers like toSee().
Boundary markers: The documentation does not specify explicit boundary markers for separating untrusted page content from agent instructions.
Capability inventory: The skill allows for browser navigation, DOM manipulation, file writing (screenshots and traces), and network requests.
Sanitization: No specific sanitization or filtering of page content is mentioned before it is processed by assertions.
[DATA_EXPOSURE]: The skill manages browser sessions and test artifacts with clear guidance on security. It explicitly recommends storing session data outside the project directory to prevent accidental commits and advises reading sensitive credentials from environment variables rather than hardcoding them in test scripts.
Evidence: Session storage in {home}/sessions and usage of getSystemSetting( "TEST_ADMIN_PASSWORD" ) for credential retrieval.

bx-playwright-testing