The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the npx motionscore command to perform runtime performance audits on specified URLs when requested by the user.
[EXTERNAL_DOWNLOADS]: The skill fetches the motion-plus package from the official Motion registry at api.motion.dev during installation.
[REMOTE_CODE_EXECUTION]: The skill facilitates remote code execution by running the motionscore package via npx and installing the motion-plus library from a remote registry URL.
[DATA_EXFILTRATION]: The motionscore CLI tool defaults to uploading audit reports to a public URL. The skill explicitly addresses this data exposure risk by instructing the agent to always include the --no-upload flag unless the user provides informed consent for an upload.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its ingestion of untrusted data during URL audits and static code reviews.
Ingestion points: Runtime URL audits via npx motionscore and static analysis of user-provided code files as described in performance-audit/index.md.
Boundary markers: The instructions mitigate risk by requiring the agent to output audit findings in a strictly defined, structured format using specific ASCII scorecard graphics.
Capability inventory: The skill has access to shell execution (npx) and package management (npm).
Sanitization: Findings are filtered through a static classification schema defined in resources/property-tiers.json before reporting.

motion