The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill automates the installation of Node.js packages '@playwright/test' and 'axe-core' using standard package managers ('npm', 'pnpm'). It also triggers the download of the Chromium browser via 'npx playwright install'. These are legitimate development tools from well-known and trusted sources.
[COMMAND_EXECUTION]: The skill uses various shell commands, including 'grep', 'find', and 'ls', to identify project structures and configuration files. It also uses 'node -e' to verify existing library installations. These operations are restricted to environment discovery and are consistent with the skill's initialization purpose.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by reading project files to generate setup summaries.
Ingestion points: The agent reads contents from 'package.json', 'playwright.config.*', and CSS files across the repository to verify the environment (detected in SKILL.md).
Boundary markers: Findings are presented in a summary table, though explicit delimiters or warnings for untrusted file content are not used.
Capability inventory: The skill possesses subprocess call capabilities for package management, browser installation, and file-write capabilities for project documentation ('CLAUDE.md' or 'AGENTS.md').
Sanitization: No input validation or sanitization is performed on the content read from repository files before it is processed for the final summary.

ui-init