The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's launcher scripts (scripts/impeccable and scripts/impeccable.cmd) are configured to download a binary executable from https://github.com/pbakaus/impeccable/releases. This repository belongs to a personal account and is not recognized as a trusted organization or a well-known service.
[REMOTE_CODE_EXECUTION]: After downloading the binary, the launcher script grants it executable permissions and runs it. Executing binary files from untrusted external sources is a high-risk activity that can lead to arbitrary code execution on the host system.
[OBFUSCATION]: The file scripts/modern-screenshot.umd.js contains minified JavaScript code. Large blocks of minified or obfuscated code are difficult to audit for hidden malicious behaviors or vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from project-level files such as PRODUCT.md and DESIGN.md, as well as content from the browser DOM in 'live mode'. This data is interpolated into prompts for generating UI code.
Ingestion points: Project configuration files (PRODUCT.md, DESIGN.md) and browser-side DOM elements.
Boundary markers: None detected in the instructions to separate external data from system instructions.
Capability inventory: The skill can execute shell commands, run external binaries, and modify source files.
Sanitization: No explicit sanitization or filtering logic is described in the provided instructions for handling external data.

impeccable