The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The 'Healer' agent workflow described in rules/e2e-ai-agents.md is designed to consume test results and automatically update source code to fix failures. This creates a surface for indirect prompt injection, as malicious content within a tested application could produce error messages that influence the agent to perform unauthorized code modifications.
Ingestion points: Test failure outputs and logs processed by the Healer agent as described in rules/e2e-ai-agents.md.
Boundary markers: None specified in the instructions to differentiate between legitimate test output and potentially injected instructions.
Capability inventory: The agent is empowered to modify test files (e.g., tests/checkout.spec.ts) and update selectors/waits.
Sanitization: No sanitization or validation of the test output is described before it is used to generate code updates.
[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes dynamic context injection (!command) in scripts/create-page-object.md to execute shell commands at the time the skill is loaded. These commands (e.g., find, grep, wc) are used to gather metadata about the project's existing test structure and configuration. While these specific commands are benign and used for project discovery, they represent automated shell execution within the user's environment.
[REMOTE_CODE_EXECUTION]: The skill instructs users to install and run packages referencing non-existent versions or tools, such as Playwright 1.59, emulate@0.9.0, and jest-axe 11.0.0 (seen in SKILL.md and rules/emulate-e2e.md). As these versions do not exist in current registries, following these instructions (e.g., npx playwright init-agents or npx playwright-cli attach) could lead to the execution of unintended or malicious third-party code if attackers register those names or versions.
[METADATA_POISONING]: The skill documentation includes future-dated claims and compatibility requirements, such as referencing 'Claude Code 2.1.277+' and April 2026 in SKILL.md. This misleading metadata obscures the skill's actual compatibility and safety profile, complicating verification of its claims.

testing-e2e