The Agent Skills Directory

Dynamic Code Execution: The skill utilizes tools such as mcp__plugin_power-pages_playwright__browser_run_code_unsafe and mcp__plugin_power-pages_playwright__browser_evaluate to perform runtime DOM discovery on live portal pages. This involves generating and executing JavaScript code to inspect elements and styles. Although this is gated by user approval prompts and intended for structural analysis, executing dynamically generated code in a browser environment is a high-privilege operation.
Indirect Prompt Injection Surface: The skill ingests and processes various local site files, including HTML, YAML, and Liquid templates, which may contain content from multiple sources. While the instructions emphasize security practices like escaping untrusted values and preserving native structures, the processing of this content represents a surface for indirect prompt injection if malicious instructions are embedded in the site's metadata or code.
Local Script Execution: The orchestration of site customization involves running several internal scripts (e.g., render-edit-site-plan.js, promote-edit-site-plan.js, validate-site.js) using the Bash tool. These scripts handle critical tasks such as plan rendering, publication, and site validation. Users should ensure the integrity of the local environment where these scripts reside.
External Data Interaction: The skill interacts with external services to fetch documentation from Microsoft Learn and verify the availability of image assets from Unsplash or other user-provided HTTPS URLs. The image verification process involves performing network GET requests to validate image content and status codes. These operations are conducted using well-known services and include bounded execution to mitigate risks.

edit-site