The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file contains the command !pwd which executes a shell command at the moment the skill is loaded by the agent to determine project context. While this specific command is benign, it demonstrates the use of load-time shell execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data through the WebFetch tool when analyzing user-provided reference URLs (Phase 2a) or scene-matched reference sites. It also uses headless browsers (Playwright/Puppeteer) to capture screenshots of external sites. There is a risk that a malicious website could contain hidden instructions aimed at influencing the agent's behavior during the 'Design DNA' extraction process.
Ingestion points: Reference URLs fetched via WebFetch in Phase 2a and reference-sites.md lookups.
Boundary markers: The instructions do not specify any delimiters or warnings to ignore embedded instructions within the fetched HTML/CSS content.
Capability inventory: The skill utilizes Read, Write, Edit, Bash, and WebFetch across its workflow files.
Sanitization: No explicit sanitization or filtering of fetched HTML/CSS content is implemented beyond the intent to extract design tokens.
[COMMAND_EXECUTION]: The agent is instructed to execute shell commands for file discovery (using ls and Glob), project context (pwd), and for visual evaluation using headless browsers (npx playwright screenshot or google-chrome --headless).
[EXTERNAL_DOWNLOADS]: During the Phase 4.5 evaluation round, the skill may download and execute code from well-known services (Microsoft's Playwright or Puppeteer via npx). It also fetches SVG assets from public CDNs like unpkg.com for icon resolution.
[PERSISTENCE]: In 'Mode C', the skill is designed to create new, permanent skill files on the user's system in the ~/.claude/skills/ directory. This is an intended feature to allow users to save extracted design systems as reusable templates.

frontend-ui