The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill navigates to and analyzes external URLs provided by the user to calculate testability scores. If a target website contains malicious instructions (e.g., hidden in HTML comments, aria-labels, or metadata), it could potentially influence the AI agent's analysis or subsequent actions. 1. Ingestion Point: The skill uses Playwright's page.goto to load external URLs in resources/templates/testability-scoring.spec.template.js. 2. Boundary Markers: Absent. There are no explicit delimiters or instructions to the agent to ignore content from the page that might resemble instructions. 3. Capability Inventory: The skill has file system write access for reports, network access for browser navigation, and execution capabilities for local scripts and browser commands. 4. Sanitization: No specific sanitization is performed on the analyzed page data before it is processed by the AI agent.
[COMMAND_EXECUTION]: The skill uses subprocess execution to automate reporting and browser workflows. Evidence: scripts/generate-html-report.js uses child_process.exec to launch the system's default browser to display the report. Evidence: resources/templates/testability-scoring.spec.template.js uses exec to invoke the report generator script after the test suite completes.
[EXTERNAL_DOWNLOADS]: The skill documentation and scripts reference and utilize external automation tools. Evidence: SKILL.md provides instructions for adding the vibium MCP tool (npx -y vibium). Evidence: scripts/run-assessment.sh invokes npx playwright test, which may download browser binaries. Playwright is maintained by Microsoft and Vibium is maintained by Jason Huggins; both are recognized as trusted technology providers.

testability-scoring