The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data which could contain malicious instructions.
Ingestion points: Reads feature descriptions, tickets, plans, and PR diffs from the project environment (SKILL.md).
Boundary markers: The instructions lack explicit requirements for delimiters or warnings to ignore embedded instructions in the ingested content.
Capability inventory: The skill has broad capabilities including browser automation (Agent Browser, Playwright), mobile testing (Appium, Detox), local file writing (HTML reports), and the ability to modify its own skill file.
Sanitization: There are no instructions provided for sanitizing or escaping external content before it is processed or included in reports.
[DYNAMIC_EXECUTION]: The skill contains self-modifying instructions that allow the agent to alter its own behavior.
Evidence: The 'Self-Improvement' section instructs the agent to 'patch this skill or the configured project-local version' if requirements are missed, which is a form of local script modification.
[CREDENTIALS_UNSAFE]: The skill's reporting mechanism may inadvertently expose sensitive data.
Evidence: Instructions require recording 'exact commands' in a text file (logs/commands.txt) and including them in a 'self-contained HTML report'. If testing involves CLI tools with secret flags or environment variables, these secrets will be written to disk in plain text.

test-feature