The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes docs/qa/testing-checklist.md from the Hummingbird theme repository to dynamically define the scope and criteria for the testing campaign.\n
Ingestion points: The scripts/checklist.js utility reads and parses the checklist markdown file.\n
Boundary markers: No specific delimiters or safety instructions are used to wrap the ingested content.\n
Capability inventory: The skill environment allows shell command execution via fingerprint.js, file system access for campaign data, and browser automation via Playwright.\n
Sanitization: No sanitization is performed on the checklist content to mitigate potential prompt injection attacks.\n- [COMMAND_EXECUTION]: The scripts/fingerprint.js script provides the capability to execute shell commands provided by the user or agent, specifically for interacting with the shop's database. The skill documentation explicitly instructs the agent to ask the user for this command and store it in the QA_SQL environment variable to protect the password from appearing in command-line arguments.\n- [DYNAMIC_EXECUTION]: The skill's architecture involves the generation of JavaScript test suites which are subsequently loaded and executed using require() within scripts/run-suite.js. This enables a modular testing workflow but represents a dynamic code loading pattern.\n- [EXTERNAL_DOWNLOADS]: The scripts/playwright-lab.sh script installs the Playwright framework, axe-core, and Lighthouse from the official NPM registry, and downloads browser binaries (Chromium, WebKit) and ffmpeg using Playwright's installer. These are recognized as well-known and trusted technology services, and the script carefully installs them into a temporary directory outside of the theme and shop folders.

hummingbird-theme-qa