The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes functionality in generate-html-report.js to serve assessment results via a local HTTP server. The server is configured to listen on all available network interfaces (0.0.0.0), potentially exposing the reports to other devices on the same network. Additionally, the script uses child_process.exec to automatically launch the system's default browser using platform-specific commands.
[INDIRECT_PROMPT_INJECTION]: The skill processes content from external websites to generate testability metrics. Untrusted data, such as URLs and metadata from the assessed page, is interpolated into the final HTML report in generate-html-report.js without explicit sanitization or escaping. This creates a surface where a maliciously crafted website could inject scripts that execute when the report is viewed locally.
Ingestion points: Target URL and page data collected in testability-scoring.spec.template.js and passed to the report generator in JSON format.
Boundary markers: The skill does not use specific delimiters or warnings to separate untrusted web data from the report's structure.
Capability inventory: Includes browser automation via Playwright, file system writes for report storage, and network service creation via Node.js http module.
Sanitization: Absent in the HTML template logic within generate-html-report.js.
[EXTERNAL_DOWNLOADS]: The generated HTML report references the Chart.js library from the JSDelivr content delivery network to render radar charts. This is a standard reference to a well-known service for visualization purposes.

testability-scoring