The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes command-line tools for visual testing and browser automation. Evidence: vibium go "$BASE_URL?lang=ar" and node .claude/skills/qe-browser/scripts/visual-diff.js in SKILL.md. These commands are used to trigger visual regression tests in a browser environment as part of the localization validation workflow.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and processes external, potentially untrusted content. 1. Ingestion points: The skill reads translation files, HTML markup, and application source code for testing (e.g., input.translations, input.html, input.code in evals/localization-testing.yaml). 2. Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the processing logic described. 3. Capability inventory: The skill can execute shell commands (vibium) and scripts (node), and it coordinates other agents (qe-test-generator, qe-test-executor, qe-visual-tester). 4. Sanitization: No sanitization or filtering of the ingested content is documented. The risk is inherent to the primary purpose of the testing skill, which requires processing external code and content.

localization-testing