The Agent Skills Directory

[COMMAND_EXECUTION]: The screenshot.js script utilizes child_process.execSync to run npx playwright install chromium if the browser is not detected. This is a standard and expected initialization step for the Playwright library to ensure its execution environment is prepared.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of the Chromium browser at runtime via Playwright. This download originates from a well-known service and is necessary for the skill's core functionality of rendering high-quality mockups.
[PROMPT_INJECTION]: The skill exhibits a potential surface for indirect prompt injection by processing external thread data provided in JSON format. \n
Ingestion points: User-provided JSON file read by render.js via the --thread argument.\n
Boundary markers: No explicit boundary markers or instructions to ignore embedded content are used between the ingested data and the rendering engine.\n
Capability inventory: The skill can perform file system writes (saving mockups) and execute shell commands (dependency installation).\n
Sanitization: The generate.js script implements an escapeHTML function that is applied to all participant names and message text before interpolation into the HTML templates, effectively mitigating potential injection attacks within the rendering context.

create-imessage-mockup