The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the way it processes external and local data without sufficient isolation.
Ingestion points: The skill navigates to external URLs to perform visual inspections and retrieves DOM structure (SKILL.md, Step 2.1). It also reads local workspace files to detect project structures and styling methods (SKILL.md, Step 1.3).
Boundary markers: There are no instructions provided to the agent to treat external content as untrusted or to use specific delimiters to separate user instructions from website content.
Capability inventory: The skill has extensive capabilities including web navigation, screenshot capture, file read/write access, and code searching across the workspace (SKILL.md, Required Capabilities).
Sanitization: The skill does not describe any sanitization or validation of the content retrieved from external web pages before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill references and recommends the use of the Playwright MCP server from Microsoft.
Evidence: The configuration example suggests using npx -y @playwright/mcp@latest to execute the tool (SKILL.md, Reference Implementation).
Source: The documentation points to the official Microsoft GitHub repository for the tool (github.com/microsoft/playwright-mcp).

web-design-reviewer