The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from multiple sources which could contain malicious instructions designed to subvert the agent's behavior.
Ingestion points: The skill reads research.md, plan.md, and content from live websites via the chrome-devtools-cli tool.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat ingested data as untrusted or to ignore embedded commands.
Capability inventory: The agent has access to powerful tools including Bash, Write, Edit, and the ability to call other skills.
Sanitization: There is no mention of sanitizing or validating external content before it is used to influence the testing checklist or reports.
[DYNAMIC_EXECUTION]: In step 5, the skill generates a 'self-contained' HTML file (compare.html) that includes inline CSS and JavaScript. This involves the agent dynamically constructing executable code based on file paths and test results, which could lead to code injection or XSS risks if the generated report is viewed by a human user without proper escaping of inputs.
[COMMAND_EXECUTION]: The skill uses $ARGUMENTS (specifically the <issue> parameter) to construct file system paths such as tmp/issues/<issue番号>/checklist.html. While usually sandboxed, this pattern presents a potential path traversal surface if the issue identifier is not validated against directory traversal characters (e.g., ../).

test