The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent in Step 2 to ask users for their email/username and password if the application requires authentication. These credentials are then hardcoded into a temporary Node.js script (screenshot-script.mjs) in plain text.
[DYNAMIC_EXECUTION]: Step 6 involves generating a Node.js script by interpolating variables (URL, credentials, and page paths) into a template and executing it using node screenshot-script.mjs. This pattern of runtime script generation and execution can be vulnerable to code injection if the interpolated values contain malicious characters designed to escape string literals.
[INDIRECT_PROMPT_INJECTION]: Step 3 instructs the agent to read various untrusted files within the codebase, including README.md, CHANGELOG.md, and routing configuration files (e.g., routes.rb, urls.py).
Ingestion points: Project documentation and framework-specific routing files.
Boundary markers: None; the agent is told to "Actually read these files" to understand features.
Capability inventory: The agent has the ability to execute shell commands (node, npm, npx) and control a browser via Playwright (navigation, clicks, form filling).
Sanitization: No sanitization or validation of the content read from the codebase is performed before it is used to plan automation steps.
[DATA_EXFILTRATION]: While the intended use is legitimate, the combination of requesting user passwords and then navigating a browser to a user-provided or codebase-discovered URL creates a significant risk for credential harvesting if the agent is directed to an attacker-controlled endpoint.

screenshots