The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to orchestrate internal audit and capture scripts. For example, scripts/finalize_visual_review.py and scripts/audit_ui.py execute audit_contrast.py and other internal components. While these calls are localized to the skill's own directory and use absolute paths, they constitute a command execution capability used for orchestration.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it ingests untrusted data from web pages and is authorized to perform automated code modifications.
Ingestion points: The tools capture_screenshots and audit_contrast (and the underlying scripts/audit_ui.py) use Playwright to load content from local or external URLs defined by environment variables or user input.
Boundary markers: The skill instructions do not include specific delimiters or warnings for the agent to ignore instructions that might be embedded within the audited UI text or captured images.
Capability inventory: The agent is explicitly instructed in SKILL.md to "Always fix actionable visual issues in code in the same turn" without prior confirmation, creating a direct path from untrusted input to filesystem and source code modification.
Sanitization: No sanitization or safety-filtering is applied to the visual content or DOM elements captured before they are processed by the agent.

visual-auditor