The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes a local Python script (scripts/gemini_analyzer.py) to process screenshots and design tokens. While this is an integrated part of the skill's workflow, it involves executing shell commands to run the script and redirect output to the filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes content from untrusted external websites provided by the user.
Ingestion points: Data is ingested via navigate_page (Phase 1), take_snapshot (Phase 1), and evaluate_script (Phase 2, 3, 5) which extract the accessibility tree and DOM elements.
Boundary markers: The instructions do not define boundary markers or delimiters to isolate untrusted web content from the agent's core logic, nor are there instructions to ignore commands potentially embedded in the website's text or metadata.
Capability inventory: The skill has significant capabilities including executing JavaScript in the browser context (evaluate_script), monitoring network requests (list_network_requests), and executing local Python scripts to interact with the Gemini API.
Sanitization: There is no evidence of sanitization or validation for the DOM content or the analysis returned by the visual analyzer before it is used to inform the agent's next steps or generate output code.

website-replicator