The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git diffs and interacts with external web pages, creating a surface for indirect prompt injection.
Ingestion points: Code changes are ingested via git diff in scripts/diff-scan.sh, and external web content is parsed via ARIA snapshots in references/execution.md.
Boundary markers: The prompt template in references/test-plan.md uses structured headers to separate diff context from instructions, but it lacks specific directives to ignore instructions embedded within the data.
Capability inventory: The skill can execute shell scripts, write files (reports and screenshots) to the local filesystem, and spawn sub-agents for browser automation.
Sanitization: Bash scripts utilize python3 -c with json.dumps() to safely escape content when generating JSON reports.
[COMMAND_EXECUTION]: The skill executes several bundled bash scripts (init.sh, diff-scan.sh, fingerprint.sh, route-map.sh, report.sh) to manage the testing lifecycle.
[EXTERNAL_DOWNLOADS]: When session recording is enabled, the skill fetches the rrweb library from the well-known jsdelivr.net CDN for browser-side injection via eval.

expect