The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from live websites during the browser-driven audit phase. This creates a surface for indirect prompt injection where malicious content on a target webpage could attempt to manipulate the agent's audit results or influence downstream actions.
Ingestion points: Webpage content, text, and structure retrieved via playwright-cli (e.g., snapshot, get_page_text).
Boundary markers: The instructions mandate a structured logging format (element, expected outcome, actual outcome) which provides some logical separation, but no explicit technical delimiters are used for external content.
Capability inventory: The skill possesses capabilities to write to the local filesystem, interact with the Notion API, and execute shell commands (playwright-cli, od, odo).
Sanitization: The instructions do not specify sanitization or escaping mechanisms for the untrusted web content before it is processed by the agent or passed to the critique phase.
[COMMAND_EXECUTION]: The skill relies on shell command execution to perform its primary functions.
Uses playwright-cli for browser automation and session interaction.
Uses od and odo (Open Design binaries) for rendering wireframes and managing project artifacts.
[DYNAMIC_EXECUTION]: The skill dynamically generates executable HTML content during the design phase.
It authors self-contained HTML files with inline CSS based on audit findings and source code analysis.
These files are registered as artifacts using the od tool, though the instructions restrict the use of external assets to ensure deterministic rendering.
[DATA_EXFILTRATION]: The skill is configured to send audit data to external services.
It publishes findings and alignment documents to Notion (app.notion.com).
This behavior is transparent and directed towards well-known services for the purpose of team alignment.

flow-friction-audit