The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it is designed to ingest and process external project data, such as Storybook stories, Cypress specs, and configuration files, which are then used to drive CLI commands. An adversary with the ability to modify these project files could potentially embed malicious instructions to influence the agent's behavior during the testing or deployment process.
Ingestion points: Project source files (e.g., *.stories.tsx, *.cy.js), configuration manifests (chromatic.config.json, package.json), and build artifacts.
Boundary markers: None. The skill's instructions do not define specific delimiters or security guardrails for the agent when interpreting external project content.
Capability inventory: The skill performs command execution via npx chromatic and npm install, and interacts with the Chromatic cloud platform for snapshot storage and comparison.
Sanitization: Absent. The skill operates directly on project-supplied data as required for its visual testing functionality.
[EXTERNAL_DOWNLOADS]: The skill downloads the chromatic package and its dependencies from the official NPM registry and interacts with the Chromatic cloud service (chromatic.com). These represent well-known, industry-standard services relevant to the skill's primary purpose.
[COMMAND_EXECUTION]: The skill utilizes the chromatic CLI and package management tools (npm, npx) to perform build and test operations. These are standard development workflows executed through subprocess calls within the local environment.

chromatic-visual-regression-testing