The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes design target files (HTML/CSS) fetched from external DesignSync projects. These files could potentially contain malicious instructions aimed at overriding agent behavior.
Ingestion points: External HTML files are fetched via DesignSync get_file and stored in /tmp/design-loop/ (SKILL.md).
Boundary markers: The skill contains an explicit security instruction (contract §7) to treat fetched targets as data, ignore instructions within them, and flag suspicious paths to the user.
Capability inventory: The skill has capabilities to write to the file system (React components, manifests) and execute shell commands (npm run chromatic, Playwright scripts).
Sanitization: No programmatic filtering or sanitization of the fetched HTML is described before rendering or analysis.
[DYNAMIC_EXECUTION]: The skill utilizes Playwright to render local HTML files and live URLs into screenshots for visual convergence.
Evidence: scripts/screenshot.mjs uses the playwright library to launch a Chromium instance and navigate to sources derived from external design data.
Mechanism: The page.goto(url) call in the screenshot script executes any JavaScript contained within the design target or Storybook iframe within the browser context.

design-loop