The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's documentation in SKILL.md provides an installation check using bash <(curl -sSL https://raw.githubusercontent.com/mizchi/skills/main/vlmkit/scripts/doctor.sh). This script, also present in the skill package as scripts/doctor.sh, is a diagnostic tool used to verify Node.js versions, package managers, and Playwright Chromium installations.
[EXTERNAL_DOWNLOADS]: The skill downloads the @mizchi/vrt CLI and related toolkit libraries from the NPM registry. It also fetches setup scripts from the vendor's official GitHub repository.
[COMMAND_EXECUTION]: The skill executes various shell commands through the vlmkit CLI to perform visual diffs, snapshots, and design token audits. It also manages browser dependencies via npx playwright install chromium.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external HTML and URLs to perform visual regression testing and layout audits, which represents a potential attack surface for indirect prompt injection.
Ingestion points: The vlmkit CLI processes baseline and variant URLs/HTML files as described in SKILL.md.
Boundary markers: No explicit boundary markers or 'ignore' instructions are provided in the skill context for handling untrusted HTML.
Capability inventory: The skill has the capability to execute shell commands via the vlmkit CLI and interact with local filesystems to save reports and PNGs.
Sanitization: No explicit sanitization or filtering of external content is documented within the skill's instruction files.

vlmkit