The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill employs modular design by dynamically loading local Python scripts at runtime using the importlib module. This includes loading internal helpers (screen_flow.py, task_report.py) and a script from a sibling directory (ui-design/scripts/check_design_kit.py) to resolve UI component references.
[COMMAND_EXECUTION]: The skill includes functionality to capture screenshots of generated reports by executing installed Chromium-based browsers (such as Microsoft Edge or Google Chrome) in headless mode via subprocess.run calls. The execution is limited to local file URIs and uses a temporary user profile.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted codebase content and structured task data to produce visual reports, which represents a surface for indirect injection if malicious instructions are present in the project files being mapped.
Ingestion points: The script scripts/render_report.py reads codebase source files and JSON-formatted task specifications (review.json).
Boundary markers: Instructions in SKILL.md guide the agent to distinguish between current code evidence and proposed designs.
Capability inventory: The skill can read codebase files, write HTML reports to the local filesystem, execute local browser processes for image generation, and request the opening of reports in a web browser.
Sanitization: The skill mitigates risks by using html.escape for text and implementing a custom parser in scripts/quick_preview.py that strips executable tags and attributes from UI fragments before rendering them in sandboxed iframes with a restrictive CSP.

codebase-map