The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute several shell commands for environment setup, dependency installation, and local script execution.
Evidence: npm install -g playwright && npx playwright install chromium used to set up browser automation.
Evidence: node scripts/skill-memory.mjs record --skill awwwards-inspiration ... used to maintain a local "flywheel" of learned rules.
Evidence: npx -y -p awwwards-mcp awwwards-index executes a package directly from the NPM registry without manual confirmation.
[REMOTE_CODE_EXECUTION]: The skill downloads media files from external URLs and processes them using system binaries (ffmpeg), which creates a potential execution vector if the remote source provides malicious media designed to exploit the parser.
Evidence: curl -o e.mp4 <video-url> && ffmpeg -i e.mp4 -vf "fps=2,scale=480:-1,tile=6x4" -frames:v 1 tile-e.jpg downloads a remote video and executes a complex processing command.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the Awwwards gallery and arbitrary live URLs provided by the user, which could contain instructions intended to influence the agent's behavior during the "inspiration loop."
Ingestion points: search_sites, get_site_details, get_site_elements, capture_live_site, and analyze_page_structure all ingest external web data.
Boundary markers: None specified to differentiate between layout/design data and embedded instructions.
Capability inventory: The skill has the ability to write to the file system (screenshots, videos, memory scripts), execute local Node.js scripts, and run shell commands (curl, ffmpeg).
Sanitization: No explicit sanitization of text content retrieved from external sites is mentioned before the agent uses it to "synthesize the direction."

awwwards-inspiration