The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands for auditing and optimization, including npm install, npx webpack-bundle-analyzer, and lighthouse audits. These are standard practices for the intended workflow.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect injection as it processes untrusted project source code and external website URLs.
Ingestion points: Website URLs for Lighthouse audits and local project source code for bundle analysis and asset optimization.
Boundary markers: No specific delimiters or instructions to ignore embedded content are provided in the workflow to separate data from instructions.
Capability inventory: File system read/write access (for asset optimization), package management (npm), and network access via CLI tools across SKILL.md examples.
Sanitization: The instructions do not define sanitization, escaping, or validation logic for the external inputs or files processed.
[DYNAMIC_EXECUTION]: The skill includes a template for an image optimization script (optimize-images.js) in SKILL.md that uses Node.js modules (fs, path, sharp) to programmatically process and write files to the local disk based on directory listings.

web-performance-optimization