The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from git diffs and live websites via Playwright, creating a potential surface for instructions embedded in data to influence the agent.
Ingestion points: Git diffs analyzed via git status and git diff in SKILL.md, and website content analyzed via playwright-cli open and eval in WORKFLOW.md.
Boundary markers: No explicit markers or instructions to ignore embedded content are present when processing external data.
Capability inventory: Shell execution (git, mkdir) and browser automation (playwright-cli) across multiple files.
Sanitization: No evidence of sanitization or validation of external content before processing.
[EXTERNAL_DOWNLOADS]: Fetches the axe-core accessibility library from Cloudflare's public CDN for automated testing.
Evidence: WORKFLOW.md contains a script that injects https://cdnjs.cloudflare.com/ajax/libs/axe-core/4.10.2/axe.min.js into the page.
[DYNAMIC_CONTEXT_INJECTION]: Utilizes shell commands at skill load time to gather context from the local git repository.
Evidence: SKILL.md uses the !command syntax to execute git status, git diff, and git log.
[REMOTE_CODE_EXECUTION]: Executes the downloaded axe-core library within the browser environment using Playwright automation.
Evidence: WORKFLOW.md uses playwright-cli eval to run the injected script from the external CDN.

design-review