The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses execSync to run npm install and npx playwright install to set up its environment in the user's home directory (~/.cache/axure-extractor).
[COMMAND_EXECUTION]: The Playwright browser is launched with the flags --no-sandbox, --disable-web-security, and --allow-file-access-from-files. These flags disable standard browser security boundaries and cross-origin policies, significantly increasing the risk of a host or browser compromise if the agent visits a malicious website.
[COMMAND_EXECUTION]: The skill uses new Function() to dynamically wrap and execute scraping scripts (e.g., extract-skeleton.js, extract-assets.js) within the Playwright browser context via page.evaluate. This represents a dynamic code execution pattern.
[EXTERNAL_DOWNLOADS]: The skill automatically downloads the playwright package and chromium binaries from external registries (npm and Playwright/npmmirror) during the initial run.
[EXTERNAL_DOWNLOADS]: The assets.mjs script downloads images, fonts, and SVGs from any URL extracted from the target webpage and saves them to the local clone-data/assets/ directory.
[DATA_EXFILTRATION]: The skill attempts to read a file (extract-theme.js) using a relative path (../../../extract-page-data/...) that accesses directories outside of the skill's own folder. This pattern can be used to probe for or harvest data from other installed skills or system directories.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It ingests untrusted data from remote URLs and presents it to the agent to guide the page reconstruction process. A malicious website could include hidden instructions within its DOM or text content to manipulate the agent's behavior.
Ingestion points: Raw HTML structure, text content, and attributes fetched via Playwright in scripts/lib/.
Boundary markers: Absent. The skill instructions do not provide delimiters or warnings to ignore instructions found within the scraped data.
Capability inventory: Subprocess execution (execSync in browser.mjs), file system write access (fs.writeFileSync), and network access (scraping and asset downloads).
Sanitization: None. Scraped text and metadata are extracted and stored in JSON format without filtering or escaping before being processed by the agent.

clone-page