The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions direct the agent to access files that typically store sensitive authentication session data.\n
Evidence: In Step 2 of SKILL.md, the agent is instructed to read auth.setup.ts and storageState configuration files. In the Playwright testing framework, storageState files are commonly used to store raw session cookies and authentication tokens in JSON format to facilitate authenticated test runs.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection due to the combination of untrusted input ingestion and code execution capabilities.\n
Ingestion points: The skill ingests user-provided descriptions via the $ARGUMENTS variable and reads project source files, including components and existing test scripts (SKILL.md Steps 1 and 2).\n
Boundary markers: The instructions do not define any boundary markers or special handling to ensure the agent ignores instructions that might be embedded within the user story or component source code.\n
Capability inventory: The agent can write new files to the filesystem (Step 6) and execute them using shell commands (Step 7).\n
Sanitization: The instructions do not specify any validation or sanitization requirements for the data used to generate the executable test code.\n- [DYNAMIC_EXECUTION]: The skill generates and automatically executes script files based on user-provided descriptions and existing project code.\n
Evidence: Step 7 in SKILL.md requires the agent to run the command npx playwright test <generated-file>. Executing code that was generated from potentially untrusted inputs creates a risk of arbitrary code execution if the generation logic is subverted.\n- [COMMAND_EXECUTION]: The skill performs shell command execution to verify the generated tests.\n
Evidence: The skill uses npx playwright test in Step 7 to run the generated test suite. While this is a common verification step, it represents a direct command execution path that utilizes dynamically created content as a parameter.

generate