The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several JavaScript and shell scripts (edges.mjs, web-frames.mjs, sheet.mjs, sim.sh) to perform design verification tasks. These scripts execute commands for browser automation via Playwright, image processing using the sharp library, video manipulation with ffmpeg, and iOS Simulator interaction via xcrun simctl. These operations are consistent with the skill's stated purpose of high-quality UI/UX design verification and use standard development tools.
[EXTERNAL_DOWNLOADS]: The documentation instructs the user or agent to install necessary Node.js dependencies using npm install within the scripts directory. The listed dependencies (playwright-core, sharp) are well-known, versioned packages from the official npm registry used for the skill's automation and image analysis features.
[DATA_EXPOSURE]: In references/assets.md, the skill provides a grep command to search .env files for the names of available API keys (e.g., OPENAI, GEMINI). This utility is designed to help the agent identify which services are configured without exposing the actual values of the secrets, as the command is restricted to outputting only the text preceding the assignment operator.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes external data such as design systems and AI-generated assets.
Ingestion points: Project design tokens, existing UI components, and assets generated from external providers (OpenAI, Gemini, etc.) as described in SKILL.md and references/assets.md.
Boundary markers: Not explicitly present in the design system ingestion phase.
Capability inventory: Browser automation via Playwright, shell command execution (scripts), and file system access for logging and captures.
Sanitization: Not explicitly performed on the visual or structured data ingested for design purposes.

charles-unreasonable-craft