The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches installation scripts for the uv package manager from astral.sh (a well-known technology service) and various developer tools like react-scan and react-grab from the unpkg.com CDN.
[REMOTE_CODE_EXECUTION]: The script scripts/perfection/lighthouse-audit.py provides instructions to install the uv environment using a curl | sh pattern. Additionally, the skill facilitates injecting remote JavaScript assets from unpkg.com into the user's project during development to enable instrumentation tools.
[COMMAND_EXECUTION]: The lighthouse-audit.py script uses subprocess.run to manage global NPM dependencies (lighthouse, chrome-launcher) and to run Node.js scripts. The skill also requires executing multiple npx commands for project initialization and dev-tooling setup.
[DYNAMIC_EXECUTION]: In scripts/perfection/lighthouse-audit.py, the skill dynamically generates a Node.js script in a temporary file and executes it via a subprocess to interface with the Lighthouse Node.js API.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided URLs for automated auditing, creating an attack surface where malicious content on the audited page could influence agent behavior.
Ingestion points: scripts/perfection/lighthouse-audit.py accepts a URL argument for auditing.
Boundary markers: Absent; there are no instructions to the auditing agent to ignore or delimit instructions found within the processed URLs.
Capability inventory: The skill can execute shell commands (subprocess.run), install packages (npm, npx), and inject scripts into browser contexts.
Sanitization: There is no evidence of URL validation or output sanitization before the URL is passed to the execution runners.

frontend