The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its core functionality requires crawling external, untrusted websites and extracting content verbatim. * Ingestion points: The agent navigates to and reads content from arbitrary URLs provided by the user or discovered during sitemap/navigation crawls (documented in SKILL.md). * Boundary markers: There are no specific instructions to the agent to treat page content as data rather than instructions, nor are there delimiters used to separate untrusted content from the system prompt. * Capability inventory: The agent has access to browser tools (Chrome/Playwright MCP), the ability to write files to the local filesystem (docs/ux-extracts/), and the ability to execute shell commands (img-process). * Sanitization: The skill lacks any mechanism to sanitize or filter the extracted text before the agent processes or saves it.
[COMMAND_EXECUTION]: The skill instructs the agent to run local shell commands to process captured data. * Evidence: SKILL.md specifies the use of 'img-process batch ./screenshots --action optimise --max-width 1440' to optimize captured images.
[DYNAMIC_EXECUTION]: The skill utilizes dynamic script injection to interact with web pages. * Evidence: The instructions in SKILL.md direct the agent to 'inject JavaScript to read computed styles' from the target web application. * Risk: While necessary for UX analysis, this capability could be abused if the agent is manipulated by malicious content on the target site.

ux-extract