The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted HTML and CSS data from arbitrary external URLs and includes it in the context for code generation subagents.
Ingestion points: The scripts/extract_page.py script fetches raw DOM and computed style data from user-provided URLs and saves it to page_data.json.
Boundary markers: The prompt template for subagents in SKILL.md lacks explicit delimiters or specific instructions to disregard agent-like directives that might be embedded in the webpage's source code.
Capability inventory: The skill allows the agent to write components to the local filesystem (src/components/), use the Task tool for orchestration, and execute development commands like npm install.
Sanitization: No sanitization or filtering of the extracted HTML content is performed before it is passed to the subagents.
[COMMAND_EXECUTION]: The skill executes local Python scripts and shell commands to perform extraction, chunking, and environment setup.
Evidence: The workflow in SKILL.md involves running python scripts/extract_page.py and python scripts/chunk_content.py. The setup process involves running pip install and browser installation commands.
[EXTERNAL_DOWNLOADS]: The skill downloads browser binaries and Python packages from official registries and well-known services.
Evidence: The README.md and scripts/setup.sh instruct the user to install dependencies from the official Python package registry and fetch the Chromium browser via the Playwright CLI. It also utilizes the official anthropics GitHub repository for installation.

perfect-web-clone