The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of 'lời business user nguyên văn' (raw business user instructions).
Ingestion points: SKILL.md defines an input field for raw user instructions used to scope the UAT tests.
Boundary markers: The skill lacks explicit instructions to ignore embedded commands within the user's raw input, although it defines rigid output formatting rules.
Capability inventory: The skill can read the codebase, execute browser automation via Playwright, write HTML files, and update wiki logs.
Sanitization: While Rule 17 mandates PII blurring for images, there is no mentioned sanitization for the input text to prevent prompt injection attacks.
[CREDENTIALS_UNSAFE]: The skill requests a 'dev-token' as a required input for bypassing authentication during Playwright automated screenshot sessions. Handling active developer tokens for internal applications poses a risk if the agent is compromised.
[COMMAND_EXECUTION]: The skill references the execution of the vercel deploy --prod --yes command. Although Rule 18 specifies that the agent should provide the command for the user to run rather than executing it autonomously, it introduces shell command patterns into the workflow.
[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses the !command syntax (! vercel deploy --prod --yes) in the documentation and rules sections. On certain platforms, this syntax can trigger shell command execution at the time the skill is loaded or processed.

uat-nonit-testcase