The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a local Node.js script (scripts/extract-blueprint.mjs) to automate the extraction of design elements like colors, typography, and layout rules from target URLs.
[EXTERNAL_DOWNLOADS]: The extraction script fetches content from external URLs using the fetch API. It implements a security validation layer (validateUrl) that performs DNS lookups and checks resolved addresses to prevent requests to private, loopback, or link-local IP ranges (SSRF protection).
[PROMPT_INJECTION]: The skill is exposed to indirect prompt injection (Category 8) because it processes content from arbitrary public websites. A malicious website could attempt to influence the agent's behavior during the synthesis of the design report.
Ingestion points: Website HTML, metadata, and CSS fetched by scripts/extract-blueprint.mjs from user-provided URLs.
Boundary markers: SKILL.md provides strict output templates (references/DESIGN_TEMPLATE.md) and grounding rules to ensure the agent stays within the design extraction scope.
Capability inventory: File system write access (to create the evidence bundle and DESIGN.md) and network access (to fetch website content).
Sanitization: The extraction script parses raw website data into structured JSON (blueprint.json), which the agent then uses as a source of truth for generating the final report.

extract