The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill automates browsing of external web applications to perform testing, creating a surface where malicious content on those sites could attempt to influence the agent's behavior.
Ingestion points: The skill uses mcp__playwright__browser_navigate and mcp__playwright__browser_snapshot to ingest content from target URLs (SKILL.md).
Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to ignore any embedded instructions found within the application UI being tested.
Capability inventory: The agent has access to sensitive local files (.env.qa), the ability to execute code in the browser context (mcp__playwright__browser_evaluate), and network capabilities to create issues on GitHub or Linear (rules/rpt-bug.md).
Sanitization: There is no mention of sanitizing or escaping the data retrieved from the web application before it is processed or used in reports.
[DATA_EXFILTRATION]: The skill is configured to read from a sensitive environment file to obtain credentials for testing purposes.
Evidence: The skill is instructed to "Read .qa/test-plan.md and .env.qa before starting" and use the QA_TEST_USER_EMAIL and QA_TEST_USER_PASSWORD values found within (SKILL.md).
[DYNAMIC_EXECUTION]: The skill utilizes browser-based code execution tools to facilitate its automated testing workflow.
Evidence: The skill utilizes mcp__playwright__browser_evaluate to interact with the web page and verify application behavior during test runs.

qa-happy-path