The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill generates an HTML file (annotation.html) by interpolating external variables such as bug keys and defect summaries. If these values originate from untrusted external sources (e.g., a maliciously titled Jira ticket) and are not sanitized, they could inject malicious scripts into the local Playwright rendering context.
Ingestion points: Jira ticket metadata (KEY, BUG-KEY, and summary) and raw screenshots from the evidence/ directory are processed as input for the annotation generator.
Boundary markers: The skill provides a copy-paste template in references/shapes.html but does not instruct the agent to use explicit escaping or sanitization when inserting text into the HTML divs.
Capability inventory: The agent has the capability to write local files (PIL and shell redirects), serve content via http.server, render content via playwright-cli, and upload files to Jira using a local bun script.
Sanitization: No explicit sanitization or escaping instructions are provided for handling the text interpolated into the callout boxes or corner badges.
[DYNAMIC_EXECUTION]: The skill uses a multi-step process involving the runtime generation of Python scripts (Step 2) and HTML documents (Step 3). While these are generated from known templates for image processing and UI overlay, they represent dynamic code execution based on session-specific parameters.
[COMMAND_EXECUTION]: The workflow relies on executing several local CLI tools, including python3 -m http.server, playwright-cli, and a vendor-provided script (.agents/skills/acli/scripts/jira-attach-media.ts) using the bun runtime. These commands incorporate potentially untrusted variables (BUG-KEY, file paths), which presents a minor risk of command injection if the agent does not properly handle argument escaping.

bug-screenshot-annotation