The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating a surface for indirect prompt injection.
Ingestion points: Untrusted data enters the context via the browser_subagent (when visiting user-provided URLs) and view_file (when analyzing user-provided videos or images) as described in SKILL.md.
Boundary markers: The instructions do not define clear delimiters or "ignore instructions" warnings for the content being audited, which could allow malicious instructions embedded in a target website or image to influence the agent.
Capability inventory: The agent has the ability to run shell commands (run_command), browse the web (browser_subagent), and read local files (view_file).
Sanitization: There is no explicit requirement for the agent to sanitize or validate the content of the audited application before processing.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to manage user-provided assets.
Evidence: The instruction in SKILL.md states: Use run_command to unzip (unzip <file> -d <dir>).
Context: This is a routine operational requirement for handling application screenshots provided in a compressed format.
[EXTERNAL_DOWNLOADS]: The skill interacts with external websites to gather audit evidence.
Evidence: Instructions in SKILL.md direct the agent to use browser_subagent to navigate to live web URLs or YouTube links provided by the user.
Context: This behavior is core to the skill's primary purpose of auditing live applications, and access is managed through the browser subagent.

ui-ux-auditor