The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill manages an inherent surface for indirect injection as it processes user-provided briefs and catalogue entries to be executed by subagents. This is mitigated through rigid architectural boundaries.
Ingestion points: scripts/prepare_run.py reads user-supplied prompt files from the local filesystem.
Boundary markers: Present in SKILL.md and agents/oneshot-lead.md, which strictly separate the 'actual prompt' (the website brief) from the 'operational envelope' (instructions for the agent).
Capability inventory: Coordinator scripts possess capabilities for local shell execution and browser automation via Playwright. Subagents are logically isolated within dedicated run directories.
Sanitization: Employs html.escape for rendering provenance indices and utilizes explicit path resolution (Path.resolve) to prevent directory traversal attacks.
[COMMAND_EXECUTION]: The coordinator utilizes shell commands to manage the environment and perform verification tasks.
Evidence: scripts/verify_directional_controls.py executes browser version checks via subprocess.run, and scripts/run_fixtures.py uses shell calls to execute package-internal test utilities.
[DYNAMIC_EXECUTION]: The framework uses JavaScript evaluation within a sandboxed browser environment for artifact verification.
Evidence: scripts/browser_session.py uses eval through Playwright to verify artifact functional state (directional control probes). These executions are restricted to internal, hardcoded templates and do not integrate raw external input.
[EXTERNAL_DOWNLOADS]: The skill requires standard development dependencies and browser binaries.
Evidence: requirements-browser.txt specifies the playwright package, and references/directional-controls.md provides instructions for downloading Chromium binaries via the official Playwright CLI.

oneshot-websites