The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the execution of two Node.js scripts, validate-app-structure.mjs and audit-runtime.mjs, to perform structural and runtime audits of the application source code and its behavior.
[INDIRECT_PROMPT_INJECTION]: The validate-app-structure.mjs script ingests untrusted application source code for static analysis. This represents an attack surface where content in the analyzed files could attempt to influence the agent's findings.
Ingestion points: The script uses fs.readFileSync to read file content from a user-provided directory (SKILL.md, Step 7).
Boundary markers: No explicit boundary markers or isolation are used for the processed content.
Capability inventory: The script identifies architectural violations and reports them via console.error, and the agent is instructed to respond only based on these findings.
Sanitization: Input source code is not sanitized; it is processed directly using regular expressions.
[DYNAMIC_EXECUTION]: The audit-runtime.mjs script utilizes the Chrome DevTools Protocol (CDP) to perform dynamic evaluation of JavaScript (Runtime.evaluate) within the context of the target web application. This is a standard procedure for automated UI auditing.
[DATA_EXFILTRATION]: The audit-runtime.mjs script performs network operations using fetch and WebSocket to connect to a user-provided CDP endpoint. These connections are local in nature (typically localhost or a dedicated debug host) and are necessary for the tool to interact with the browser session being audited.

uit-screen-architecture-web