The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill possesses a high-risk attack surface for indirect injection because it processes untrusted data from external websites while maintaining powerful capabilities.
Ingestion points: The agent loads and interacts with web content via page.goto() in login.spec.ts, load.spec.ts, and create.spec.ts.
Boundary markers: None; there are no instructions to help the agent distinguish between test logic and potentially malicious prompts embedded in the target website.
Capability inventory: The agent has the ability to interact with web UIs (click, fill) and perform administrative cleanup via the fetch API in helpers/users.ts using an ADMIN_TOKEN.
Sanitization: None; data retrieved from the browser is not filtered or escaped before being processed by the agent.
[Unverifiable Dependencies] (LOW): The skill relies on external packages (playwright, @playwright/test) and browser binaries downloaded from the NPM registry. While these come from a trusted source (Microsoft), they constitute external code dependencies.
[Command Execution] (LOW): The skill instructions involve executing shell commands (npm install, npx playwright test) to set up the environment and run tests, which is a standard but necessary part of the attack surface.

qa-regression