The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the AI to prompt users for login credentials (email and password) and store them in plain text within a .github/copilot-instructions.md file. Storing sensitive credentials in markdown files, particularly within the .github directory which is commonly committed to version control, is an unsafe practice that risks credential exposure.
[COMMAND_EXECUTION]: The skill executes several shell commands to manage the development environment, including yarn build, yarn start, and process termination using lsof and kill -9. While these are standard for local development, they grant the agent the ability to execute arbitrary commands and manage system processes.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection (Category 8) due to its interaction with external web content during the 'Test' phase.
Ingestion points: Browser content retrieved via Playwright MCP commands (e.g., browser_snapshot, browser_navigate) and configuration data read from .github/copilot-instructions.md (SKILL.md).
Boundary markers: Absent. The instructions do not provide delimiters or warnings to the agent to distinguish between instructions and data retrieved from web pages.
Capability inventory: The agent has the capability to modify project code (MODIFY step), execute shell commands (build/start/kill), and perform network requests via curl (SKILL.md).
Sanitization: Absent. There is no mechanism described to sanitize or validate the content retrieved from the browser before it is used to inform code modifications or subsequent actions.

steedos-dev-testing