The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes several scripts (asset-harvest.mjs, mirror-site.mjs, route-crawl.mjs, network-capture.mjs, sourcemap-hunt.mjs) that perform network requests to fetch assets, crawl URLs, and download remote content such as source maps and binary assets from user-specified websites.
[COMMAND_EXECUTION]: The methodology involves running a suite of local Node.js scripts to perform reconnaissance and cloning tasks. It also uses the gh (GitHub) CLI tool to search for repository metadata. The script scripts/lib/playwright-loader.mjs dynamically searches for the playwright dependency across various hardcoded absolute paths on the local filesystem (e.g., in /Users/jane/).
[DATA_EXFILTRATION]: The network-capture.mjs script records XHR and fetch traffic (including request and response bodies) from target websites and saves them as local files. While intended for creating mocks/fixtures for developers, this capability allows for the capture of data from external web sources.
[PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection as it processes and analyzes content from arbitrary websites.
Ingestion points: recon-site.mjs and route-crawl.mjs extract text, headings, and metadata from external web pages.
Boundary markers: The skill does not use specific delimiters or instructions to prevent the agent from following directions found within the scraped content.
Capability inventory: The skill has network access, file system write permissions, and executes local Node.js scripts.
Sanitization: Text content is extracted from the DOM and included in analysis reports without filtering for potential injection strings.

web-clone