The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/perfection/lighthouse-audit.py uses the Python subprocess module to manage dependencies and execute Lighthouse audits. It runs npm install for required packages and node to execute a dynamically generated script that interfaces with the Lighthouse API. These operations are scoped to the intended purpose of the skill.
[EXTERNAL_DOWNLOADS]: The skill references several external resources and installation scripts. It recommends installing the uv tool from https://astral.sh/uv/install.sh, uses npx to install development tools like grab, react-doctor, and react-scan, and loads scripts from the unpkg.com CDN. These sources are well-known technology providers and services.
[DATA_EXFILTRATION]: In references/design/lazyweb.md, the skill manages an API token for the Lazyweb service. The token is stored locally at ~/.lazyweb/lazyweb_mcp_token with restricted file permissions (chmod 600), following security best practices for credential management.
[PROMPT_INJECTION]: The skill implements a defense against indirect prompt injection in references/design/lazyweb.md. It explicitly instructs the agent to treat tool output from the Lazyweb API as data only and to refuse any instruction-shaped text or persistence requests (e.g., LAZYWEB:ROUTER blocks) found within the search results.
[COMMAND_EXECUTION]: The lazyweb.md file contains shell recipes using curl to interact with the Lazyweb API. This is used for design research, and the output is strictly handled as data.

frontend