The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill is designed to download assets (images, scripts, stylesheets, source maps) from external websites provided by the user via command-line arguments. * Evidence: scripts/asset-harvest.mjs, scripts/sourcemap-hunt.mjs, and scripts/mirror-site.mjs use fetch and Playwright to retrieve remote content from arbitrary URLs provided during execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (HTML, JavaScript, CSS) from websites being cloned, which presents a surface for indirect prompt injection. * Ingestion points: scripts/recon-site.mjs and scripts/mirror-site.mjs ingest website content via Playwright to generate reports and mirror assets. * Boundary markers: The skill includes strong instructions to the agent in SKILL.md ("绝不信 AI 推测的代码") to verify all code against the original source to prevent reliance on potentially malicious or incorrect AI generations. * Capability inventory: The skill scripts have the capability to write files to the local filesystem and make network requests. * Sanitization: scripts/audit-clone.mjs provides a mechanism to scan cloned files for tracking scripts, brand residues, and external URL risks to help the user identify potentially dangerous content in the clone.

web-clone