The Agent Skills Directory

[PROMPT_INJECTION]: No attempts to override agent behavior, bypass safety filters, or extract system prompts were detected in the instructions or trigger phrases.
[DATA_EXFILTRATION]: The skill does not access sensitive file paths (e.g., credentials, SSH keys) or perform network operations to external domains. Interaction is limited to the local DOM and standard browser APIs.
[OBFUSCATION]: All code and instructions are provided in plain text. No Base64, zero-width characters, homoglyphs, or other obfuscation techniques were found.
[REMOTE_CODE_EXECUTION]: The skill does not download or execute scripts from remote servers. It provides local JavaScript and CSS snippets for implementation.
[INDIRECT_PROMPT_INJECTION]: The hero stat counter script ingests text content from the DOM (el.textContent). However, it uses a strict regular expression (/^(\d{1,3}(?:([.,])\d{3})*|\d+)(\D*)$/) to validate and extract only numeric data and suffixes, preventing the processing of arbitrary strings. The skill lacks capabilities for network communication or file system writes, eliminating risks of data exfiltration or system modification.
[DYNAMIC_EXECUTION]: No use of eval(), exec(), or unsafe deserialization was found. The use of page.evaluate in the Playwright test template is a standard and safe practice for web testing automation.
[DYNAMIC_CONTEXT_INJECTION]: No dynamic context injection patterns (e.g., shell commands in markdown) were detected.
[PRIVILEGE_ESCALATION]: The skill does not request or attempt to acquire elevated system permissions.

website-motion