The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Hardcoded dummy credentials are used in multiple code examples within the instructions.
Evidence: email: 'admin@example.com', password: 'AdminPass123!' found in the fixtures/api.fixture.ts and authentication testing snippets.
Evidence: Authorization: 'Bearer admin-token-here' used in the advanced patterns section.
[DATA_EXFILTRATION]: Exposure to Indirect Prompt Injection (Category 8).
Ingestion points: External API responses are ingested into the agent context via response.json() in numerous test examples.
Boundary markers: Absent; there are no delimiters or instructions provided to ignore potentially malicious content embedded in the API responses.
Capability inventory: The skill primarily uses Playwright's expect library for assertions; no critical capabilities like eval() or arbitrary subprocess execution were detected in the data processing flow.
Sanitization: Absent; the code snippets parse raw JSON directly from network responses without sanitization.
[SAFE]: The skill explicitly promotes security best practices in its documentation, advising users to 'Use environment variables -- Never hardcode URLs or credentials'.
[SAFE]: The file upload example uses path.resolve to restrict file access to the local test-data directory.

playwright-api