The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/test_runner.py uses subprocess.run to execute testing frameworks such as npm test and pytest. This allows the agent to run code defined in the local project environment.
[REMOTE_CODE_EXECUTION]: scripts/test_runner.py detects project types and triggers execution based on the presence of package.json or pyproject.toml. This creates a vector for indirect code execution if an agent is directed to test a repository containing malicious test scripts or configurations.
[EXTERNAL_DOWNLOADS]: scripts/playwright_runner.py facilitates network navigation to any user-provided URL for automated testing. Additionally, the skill utilizes well-known external dependencies and tools including Playwright, Pytest, Jest, and Vitest.
[PROMPT_INJECTION]: The skill contains an indirect prompt injection surface where untrusted data could influence agent behavior.
Ingestion points: scripts/test_runner.py reads local configuration files (package.json, pyproject.toml), and scripts/playwright_runner.py processes external URLs.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the scripts or documentation.
Capability inventory: The skill possesses high-privilege capabilities including system command execution through subprocess and network communication via Playwright.
Sanitization: There is no evidence of validation or sanitization of the input data from project files or external web content before processing.

testing-mastery