The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for hosting the cloned site using npx serve {output_dir} or python3 -m http.server 3456 -d {output_dir}. Since the output_dir parameter is a user-supplied input, this creates a significant risk of command injection if the agent interpolates the variable directly into a shell context.
[EXTERNAL_DOWNLOADS]: The skill recommends installing the Playwright MCP server from a public registry and uses the serve package for local testing. These are downloads from well-known services (Microsoft/Playwright and Vercel/serve) used for the skill's primary functionality.
[DYNAMIC_EXECUTION]: The skill utilizes browser_evaluate to run specific JavaScript snippets within the target website's browser context. These snippets are used to programmatically extract the DOM tree, computed styles, and interactive elements.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection as it ingests raw text and semantic structures from arbitrary external websites.
Ingestion points: Data is collected in SKILL.md during Pass 1 using the browser_snapshot and browser_evaluate tools.
Boundary markers: The instructions do not define any delimiters or warning markers to prevent the agent from following instructions embedded within the target website's text content.
Capability inventory: The skill has the ability to write files to the local disk and execute shell commands for serving content.
Sanitization: There is no specified logic to sanitize or filter the extracted strings before they are used to generate the application logic in Pass 3.

web-clone