The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads several software packages and tools during its operation. It uses npm to install project dependencies and npx to initialize Next.js projects via create-next-app. Additionally, it installs the playwright and Pillow libraries via pip for site discovery and visual validation. These downloads originate from well-known registries and official sources.
[COMMAND_EXECUTION]: To achieve its goal of creating a production-ready project, the skill executes various shell commands. These include initializing the project structure, installing dependencies, and running npm run build and npm run dev to verify the generated code.
[DYNAMIC_EXECUTION]: This skill dynamically generates a complete Next.js or Vite project by converting HTML fragments into JSX components and CSS modules. It then executes this generated code by starting a development server and performing build checks.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, specifically the HTML content of cloned websites. This content is ingested through the Read tool or via URL crawling using Playwright. Since the agent interprets this content to determine component structure and interactivity, there is a theoretical surface for instructions embedded within the source HTML to influence the agent's behavior. The skill possesses capabilities such as shell command execution (Bash) and file system access (Write) which could be targeted. No specific sanitization or boundary markers are documented to mitigate this risk.

frontend-reactor