The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using curl, ffmpeg, and node. This includes downloading remote videos and processing them (curl -o e.mp4 <video-url> && ffmpeg ...) and running a local memory management script (node scripts/skill-memory.mjs).
[EXTERNAL_DOWNLOADS]: The skill requires the installation of several external dependencies, including playwright, ffmpeg-static, and the vendor's own awwwards-mcp package. It also uses npx -y to execute unverified packages and instructs the agent to download video files from arbitrary remote URLs.
[DATA_EXFILTRATION]: Multiple tools within the skill, such as analyze_page_structure and capture_live_site, support the file:// protocol. This allows the agent to read and capture screenshots of local system files. Additionally, the analyze_network_capture tool processes HAR files, which typically contain sensitive session tokens and cookies.
[DYNAMIC_EXECUTION]: The _memory/techniques.json file contains JavaScript snippets intended for execution within a browser context via page.evaluate. It also suggests using webcrack to de-obfuscate and analyze remote script chunks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted content from the web, creating a surface for indirect injection.
Ingestion points: Site descriptions, metadata, and live HTML structure retrieved via search_sites, get_site_details, and capture_live_site in SKILL.md.
Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard embedded commands in the analyzed web content.
Capability inventory: The agent has access to shell execution (curl, ffmpeg), browser automation (playwright), and file system reading/writing across all scripts.
Sanitization: No evidence of sanitization or validation of external data before it is processed by the agent or its tools.

awwwards-inspiration