The Agent Skills Directory

[OBFUSCATION]: The skill contains zero-width characters (U+200B, U+200C, U+200D), byte order marks (U+FEFF), and right-to-left overrides (U+202E). These are explicitly defined within a PASTE_BOMBS object in SKILL.md as adversarial input for testing if the target application's UI can handle unusual character sequences without crashing.
[INDIRECT_PROMPT_INJECTION]: The generated ErrorMonitor class captures data from the web page under test, including console logs, unhandled exceptions, and network response text. If the target application processes and reflects attacker-controlled data into these logs, it could potentially be used to influence the agent's context.
Ingestion points: Captured console messages, page error events, and network response metadata in SKILL.md via Playwright event listeners.
Boundary markers: The skill does not implement delimiters or explicit 'ignore instructions' warnings for the captured browser data.
Capability inventory: The generated scripts have the capability to interact with the browser and network via the Playwright framework, and the agent may write test results to the file system.
Sanitization: Captured strings are aggregated into a report without specific sanitization or escaping of potential instructions.
[COMMAND_EXECUTION]: The skill generates instructions for automated browser interactions (clicks, keyboard input, navigation) using the Playwright framework. These commands drive a headless or headed browser process to interact with external web applications.
[DATA_EXPOSURE]: The skill includes strings like ../../../etc/passwd and ${process.env.SECRET} in a list of specialInputs. These are used as literal test payloads to check if the target web application is vulnerable to path traversal or environment variable leakage; the skill itself does not attempt to access the agent's local files or environment variables.

Angry User Simulator