The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script "scripts/verify-payload.mjs" uses "new Function()" to evaluate and expand data payloads (specifically Nuxt 2 IIFEs) extracted from the mirrored HTML of a target website. Since the input for this evaluation is fetched from an external, untrusted URL provided by the user, this pattern creates a risk of arbitrary code execution in the Node.js process if the target website is malicious.
[COMMAND_EXECUTION]: Several scripts (e.g., "scripts/beautify-bundle.mjs", "scripts/module-map.mjs", "scripts/verify-fresh.mjs") use "spawnSync" or "spawn" to execute external tools like "npx", "acorn", "js-beautify", and "esbuild". While these tools are pinned to specific versions and are well-known in the JavaScript ecosystem, the dynamic spawning of sub-processes based on project configuration files is an inherent risk in build-tooling skills.
[EXTERNAL_DOWNLOADS]: The skill uses "fetch" in various scripts (e.g., "scripts/mirror-site.mjs", "scripts/netcapture.mjs") to download HTML, JavaScript, and asset files from arbitrary URLs provided by the user. While this is the core function of a website cloning tool, it involves connecting to untrusted external hosts.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze untrusted data from the web (crawled websites). This creates a surface for indirect prompt injection where malicious instructions embedded in the target site's code or comments could potentially influence the agent's analysis or subsequent porting actions.
Ingestion points: "scripts/mirror-site.mjs", "scripts/netcapture.mjs", and "scripts/fingerprint.mjs" fetch external content into the agent's workspace.
Boundary markers: The skill relies on verbatim mirroring and doesn't explicitly use delimiters to separate untrusted content from its own instructions, although it uses specific files for its 'engine notes' and 'rebuild plan'.
Capability inventory: The skill possesses extensive capabilities including file system modification, network communication, and sub-process execution.
Sanitization: No sanitization is performed on the ingested content as the goal is byte-faithful reproduction.

website-rebuild