The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and installs the @vercel/before-and-after package from the official npm registry. This is a standard and expected operation for the skill's purpose.
[COMMAND_EXECUTION]: The skill executes various shell commands for its core functionality, such as curl for checking URL status, gh for GitHub integration, and vercel for deployment inspection. These commands are within the expected scope of a development tool.
[DATA_EXFILTRATION]: The skill uploads screenshots to external services like 0x0.st, GitHub Gists, or a custom user-defined endpoint. While this involves sending local files to the internet, it is the primary stated purpose of the skill (sharing visual diffs) and is initiated by the user or as part of a documented workflow.
[PRIVILEGE_ESCALATION]: The skill uses npm install -g to set up its dependencies. While global installation requires appropriate permissions, it is a standard practice for CLI tools and does not constitute malicious escalation.
[DYNAMIC_EXECUTION]: The skill uses a pluggable adapter system where it executes shell scripts located in scripts/adapters/ based on an environment variable (IMAGE_ADAPTER). The paths are validated against existing files in the skill's own directory, preventing the execution of arbitrary external scripts.

before-and-after