The Agent Skills Directory

[SAFE]: The skill is designed for fidelity checks between web prototypes and builds, which is a standard development and QA task. The tool is authored by a known and trusted vendor.
[COMMAND_EXECUTION]: The skill executes local Node.js scripts that drive a browser via Playwright. This execution is confined to the specific comparison tasks described in the documentation and does not involve spawning unauthorized subprocesses.
[EXTERNAL_DOWNLOADS]: The skill instructions guide the user to install well-known and trusted npm packages (playwright, pixelmatch, pngjs, cheerio) for its operations, which is standard practice for tools of this nature.
[CREDENTIALS_UNSAFE]: Site-specific authentication tokens are handled securely through environment variables (e.g., SITE_TOKEN in .env), aligning with best practices for secret management and avoiding hardcoded credentials.
[DYNAMIC_EXECUTION]: The analysis logic is injected into the browser context using Playwright's page.evaluate(). The injected code is composed of local, static library functions defined within the skill's scripts and does not execute arbitrary or untrusted code from the web pages being analyzed.
[INDIRECT_PROMPT_INJECTION]: While the skill ingests content from external web pages, it processes this data into structured comparison reports. The potential for indirect prompt injection is limited to the text extracted for display, and the skill does not autonomously execute instructions found within the processed content.

diff