The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from live browser content (snapshots and accessibility trees) and a story catalog. This data directly influences the agent's logic for generating UX findings and subsequently applying automated code fixes.
Ingestion points: Browser snapshots and DOM content processed in Phase 2a, and the story catalog file docs/ux-paths/catalog.md processed in Phase 1.
Boundary markers: The instructions for the walker sub-agent do not include explicit delimiters or warnings to ignore potential instructions embedded within the audited web content.
Capability inventory: The skill possesses significant capabilities, including shell command execution (Bash), file modification (Write), and Git repository operations (git, gh).
Sanitization: There is no evidence of sanitization or filtering of the browser content before it is evaluated by the walker agent to determine findings.
[COMMAND_EXECUTION]: The skill performs multiple shell-based operations, including using curl to check URL responsiveness, lsof to detect running development servers, and standard build tools like npm run build or cargo build to verify fixes. It also uses git for worktree management and the gh CLI to interact with GitHub for issue reporting.
[DYNAMIC_EXECUTION]: A core feature of the skill is the automated generation and application of code fixes in Phase 2c. Fix sub-agents are tasked with modifying source code based on audit findings. While these changes are verified via build scripts and managed within isolated worktrees, the logic driving the code generation originates from potentially untrusted browser data.
[EXTERNAL_DOWNLOADS]: The skill interacts with external network resources by performing HTTP requests via curl to the target application URL and communicating with GitHub's official API through the gh CLI for issue management.

ux-walker