The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses npx playwright screenshot and xcrun simctl to capture UI states. The inclusion of user-provided variables like {url} and {port} directly into shell command strings (e.g., npx playwright screenshot --full-page {url} ...) presents a command injection risk where a malicious user could execute arbitrary code by supplying a crafted URL containing shell metacharacters.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to run npx playwright, which involves downloading and executing Node.js packages from the npm registry. While Playwright is a legitimate tool, runtime execution of unpinned external packages can be a vector for supply chain attacks.
[DATA_EXFILTRATION]: The skill provides instructions to capture screenshots of localhost:{port}. This capability can be abused to perform Server-Side Request Forgery (SSRF) style attacks, allowing an agent to visualize and potentially expose sensitive information from internal services running on the host or local network.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it ingests untrusted data from WebSearch and WebFetch to summarize trends.
Ingestion points: External content from URLs and search results in Step 2.
Boundary markers: Absent; the skill does not use delimiters to isolate external research data from its core instructions.
Capability inventory: Subprocess execution via npx playwright and xcrun simctl.
Sanitization: Absent; search results are processed directly to extract patterns and values.

ui-review