The Agent Skills Directory

[METADATA_POISONING]: The skill contains deceptive claims regarding software versions and verification dates across multiple files. Evidence includes references to non-existent Playwright versions (v1.59 and 1.60) and verification dates in July 2026. This deceptive metadata could lead users to believe they are following patterns for a non-existent future version of the software.
[INDIRECT_PROMPT_INJECTION]: The skill defines an AI agent workflow (Planner/Generator/Healer) that interacts with live web applications, creating a vulnerability surface for indirect prompt injection.
Ingestion points: Web content and application data are ingested via Playwright locators and tools like WebFetch.
Boundary markers: There are no explicit delimiters or instructions provided to isolate or ignore potential instructions embedded within the target application's content.
Capability inventory: The agents have access to npx commands, shell execution through dynamic context placeholders, and the ability to generate new test scripts.
Sanitization: No evidence of sanitization or validation of the external web data is present before it influences the agent's code generation.
[DYNAMIC_CONTEXT_INJECTION]: The create-page-object.md file utilizes the !command syntax to execute shell commands at load time.
Evidence: The skill uses commands such as find, grep, and date to gather environmental context like existing page objects and test directories.
Risk Assessment: The commands appear benign and are used for environment detection in a development workflow. No user input is directly passed into these commands, mitigating command injection risks.

testing-e2e