The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites to perform its audit, which could be used to manipulate the agent's behavior or reporting.
Ingestion points: Website content is ingested via browser_snapshot (accessibility tree) and browser_screenshot during the App Discovery and Scenario Execution phases in SKILL.md and categories.md.
Boundary markers: The instructions do not define clear delimiters or "ignore" instructions to separate website content from the agent's analysis logic.
Capability inventory: The agent has the ability to write files (Write tool for reports) and execute shell commands (Bash tool for mkdir and gh issue create).
Sanitization: There is no evidence of sanitization or validation of the data retrieved from the browser before it is used to generate report content or GitHub issues.
[COMMAND_EXECUTION]: The skill uses shell commands to manage files and interact with external services.
Evidence: The workflow in SKILL.md includes mkdir -p to create local directories for screenshots and gh issue create to register detected gaps as issues on GitHub.
Context: These commands are used for the skill's stated purpose of reporting, but they represent a vector where injected content could influence command arguments.

ux-gap-detector