The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/wireframe.js script fetches the wireloom package (version 0.7.0) from the public NPM registry if it is not already available in the project or the user's cache directory. The installation is performed using security flags such as --ignore-scripts to mitigate supply chain risks.
[DYNAMIC_EXECUTION]: The skill uses Node.js require to dynamically load the wireloom library at runtime. This execution is limited to the functions provided by the library for parsing and rendering wireframe sources.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and transcribe existing HTML pages into wireframes, which introduces an attack surface where malicious instructions embedded in those files could influence the agent.
Ingestion points: The agent reads user-provided HTML source files as part of the conversion process, and the scripts/wireframe.js script reads file metadata from existing wireframe documents.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used when the agent processes the input HTML content to prevent the execution of instructions contained within the data.
Capability inventory: The skill possesses the capability to read and write files, and execute a local Node.js script which can perform network operations (via npm install).
Sanitization: The instructions suggest focusing on the HTML body and ignoring decorative elements, but no automated sanitization or filtering is applied to the input data before the agent processes it.

wireframe