The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches the playwright package and Chromium browser binary.
Evidence: SKILL.md Step 4 commands: pip install playwright and playwright install chromium.
Context: These are standard dependencies for the skill's screenshot functionality, sourced from official providers.
[COMMAND_EXECUTION]: Executes shell commands to manage a Python environment and run internal scripts.
Evidence: Uses Bash to run capture_screenshot.py and check_overflow.py for rendering and layout validation.
[INDIRECT_PROMPT_INJECTION]: Processes untrusted requirements documents which could contain malicious instructions.
Ingestion points: Requirements documents provided via $ARGUMENTS.
Capability inventory: File writing (Write), command execution (Bash), and rendering in a browser.
Sanitization: Implements a strict static HTML policy. The _WireframeAuditor class in check_overflow.py detects and blocks all <script> elements, on* event handlers, and iframe srcdoc content before the browser is invoked.
[DYNAMIC_EXECUTION]: Renders generated HTML in a headless browser to produce image artifacts.
Security Controls: Playwright routing in both capture_screenshot.py and check_overflow.py intercepts all network requests, aborting any that target external domains or local files outside the document's specific directory. Only specific raster image types (.png, .jpg, etc.) are allowed for storyboard generation.

create-design-doc