The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The package.json includes a postinstall script that downloads the Chromium browser binary.
Evidence: package.json contains "postinstall": "npx playwright install chromium".
Description: This fetches the browser binary from official Microsoft/Playwright sources to enable auditing capabilities.
[COMMAND_EXECUTION]: The skill executes shell commands to facilitate local file analysis and environment setup.
Evidence: src/server.ts and scripts/run-lighthouse.js use spawn to run npx serve for hosting local HTML files.
Evidence: scripts/run-lighthouse.sh executes pnpm and node to manage dependencies and run the application.
Description: These commands are used to invoke well-known development tools and project utilities.
[PROMPT_INJECTION]: The skill analyzes external websites and local files, creating a surface for indirect prompt injection.
Ingestion points: Untrusted data from website audits (titles, descriptions, audit results) is extracted in src/runner.ts and scripts/run-lighthouse.js.
Boundary markers: The final report in src/reporter.ts uses Markdown headers (e.g., ## Scores, ## Core Web Vitals) to structure the data, though it lacks explicit "ignore instructions" warnings for the ingested content.
Capability inventory: The skill has the capability to execute shell commands (spawn) and perform network operations via browser automation.
Sanitization: The audit content is interpolated directly into the report string without escaping or sanitization.

lighthouse-runner