The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through multiple ingestion points for untrusted external data. Ingestion points: The skill fetches Pull Request details, including titles, descriptions, and comments in Step 1, and interacts with arbitrary web applications using the browser-use plugin in Step 5. Boundary markers: There are no explicit instructions or delimiters defined to isolate or treat external content as untrusted data. Capability inventory: The skill has high-impact capabilities including direct terminal execution, automated browser interaction, and the ability to write to shared external systems. Sanitization: No sanitization, filtering, or escaping of the fetched PR content or web data is specified.
[COMMAND_EXECUTION]: The skill explicitly allows for direct terminal execution to run CLI tools, launch development servers, and execute integration tests. While this is the intended purpose of a testing skill, this capability can be abused if the agent is influenced by injected instructions from the PR comments or web pages it interacts with.

smoke-test