The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data such as HTML snippets and UI component trees to perform its audit functions. Mandatory Evidence Chain: 1. Ingestion points: Audited UI code and interface descriptions entered during invocations (e.g., checkout page HTML in Case 3 of trigger-evals.json). 2. Boundary markers: Absent; the instructions do not mandate delimiters or warnings to ignore instructions embedded in audited data. 3. Capability inventory: The agent is instructed to write audit artifacts to the filesystem (docs/audits/ or audit-artifacts/). 4. Sanitization: Absent; no validation or escaping of the input content is performed before processing. This creates a surface for indirect prompt injection where malicious instructions hidden in audited code could influence the agent's output or report generation.
[COMMAND_EXECUTION]: The skill package includes a shell script (evals/run-static-checks.sh) that utilizes bash, jq, and inline Python for static validation and integrity checks of the skill's own configuration and playbooks. While this script is intended for development-time verification and not for the agent's primary task execution, it represents an executable component within the skill structure.
[SAFE]: The skill implements a structured workflow with clear boundaries, specifically avoiding developer-facing surfaces like APIs or CLIs. File-writing capabilities are strictly limited to recording audit results in specific directories with predefined filename patterns, and the skill does not perform unauthorized network requests or access sensitive credentials.

ux-audit