The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the execution of multiple local scripts to perform its analysis and comparison tasks, including scripts/scan_source.py, scripts/analyze.py, scripts/compare.py, scripts/receive.mjs, and scripts/snapshot.mjs. These are executed via the agent's shell environment.
[DYNAMIC_EXECUTION]: The scripts/snapshot.mjs script performs dynamic loading of external browser automation libraries from the environment.
Evidence: It uses createRequire to locate and load playwright, playwright-core, puppeteer, or puppeteer-core from the project's node_modules or the global environment if they are available.
[INDIRECT_PROMPT_INJECTION]: The skill processes the project's source code, creating a surface for indirect prompt injection if project files contain malicious instructions.
Ingestion points: scripts/scan_source.py reads and analyzes project files (e.g., .tsx, .css) to extract component names and design tokens.
Boundary markers: No delimiters or specific safety instructions are provided to the agent to disregard instructions that might be embedded within the source code being analyzed.
Capability inventory: The skill possesses file-system read/write capabilities and shell command execution across several scripts.
Sanitization: While the scripts use regular expressions for targeted data extraction (e.g., CSS properties), the extracted content is presented to the agent in Markdown summaries, potentially allowing embedded text to influence the agent's next steps.

design-catalog