The Agent Skills Directory

[COMMAND_EXECUTION]: The verify_dev.py script executes arbitrary build and startup commands defined in the sdlc/env/dev.md configuration file. These commands are executed using subprocess.run(shell=True) and subprocess.Popen(shell=True) in the run_step and boot_service functions. This allows for arbitrary code execution on the host machine if the configuration file is compromised.
[DYNAMIC_EXECUTION]: During the spec phase, the skill translates natural language test cases from cases.md into TypeScript code for Playwright (.spec.ts files). These generated scripts are then executed by the Playwright runner. This represents a dynamic code generation and execution pattern based on potentially untrusted requirement descriptions.
[CREDENTIALS_UNSAFE]: The skill is designed to manage and read sensitive information from local configuration files such as accounts.local.md and dev-auth.local.md. These files are intended to store plaintext credentials (passwords, tokens) for the test environment. While the skill recommends using .gitignore, the AI agent is explicitly directed to read this sensitive data into its execution context to perform testing operations.
[INDIRECT_PROMPT_INJECTION]: The skill's testing workflow has a significant surface area for indirect prompt injection because it ingests data from external sources during the exec phase.
Ingestion points: Web page content via chrome-devtools:take_snapshot, API responses via chrome-devtools:get_network_request, and database records via mysql:mysql_query.
Boundary markers: The exec-dispatch.md protocol uses section markers (e.g., 【...】) to separate instructions for sub-agents.
Capability inventory: Testing agents have access to browser manipulation, network request inspection, database querying, and local file reading/writing within the sdlc/ directory.
Sanitization: The skill lacks explicit sanitization or escaping of external content, relying instead on "Red Lines" and "Anti-Rationalization" instructions to guide agent behavior.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of external dependencies. It instructs the user to run npm install in the sdlc/ directory. The provided templates/runner/package.json pins the @playwright/test package to version 1.61.0.

sdlc-test