The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill manages sensitive environment variables and authentication tokens. It copies ".env" files from the root repository to individual worktrees and extracts Claude OAuth tokens from the host system's configuration files (e.g., "~/.claude/.credentials.json") or the macOS keychain. It also prompts users for test credentials when environment variables are missing.
[COMMAND_EXECUTION]: The skill performs extensive shell command execution to manage the testing lifecycle. This includes using "docker exec" for direct database and Redis manipulation, "lsof" and "pkill" for managing host-side processes, and the "gh" CLI for interacting with GitHub repositories.
[DYNAMIC_EXECUTION]: The skill includes a fallback testing path that dynamically generates and executes JavaScript using "node -e" to control the Playwright browser automation library.
[DATA_EXFILTRATION]: As part of the reporting workflow, the skill uploads local screenshots to GitHub's public asset storage using "gh pr comment --attach". While this is a functional requirement for the test report, it involves transferring local files to a remote service.
[EXTERNAL_DOWNLOADS]: The skill executes "playwright install chromium", which downloads browser binaries from external servers to the local host machine.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from pull request bodies, titles, and git logs which are used within shell variables and displayed in GitHub comments.
Ingestion points: PR descriptions fetched via "gh pr view", git logs, and API response values.
Boundary markers: No explicit delimiters are used for the ingested content in the agent's context.
Capability inventory: The skill has access to "docker exec", process management commands, GitHub CLI operations, and network operations via "curl".
Sanitization: The skill performs basic slugification on PR titles before using them in file paths.

pr-test