The Agent Skills Directory

Processing of Untrusted Web Content: The skill ingests text, layout, and component data from arbitrary external URLs to recreate them locally. This activity introduces a potential surface for indirect prompt injection, where instructions hidden within a website's content could attempt to influence the agent's actions.
Ingestion points: External content is gathered from the target URL using browser DOM tools as described in SKILL.md.
Boundary markers: The workflow includes a warning for the user regarding terms of service, but it does not specify technical delimiters to isolate untrusted web data from the agent's instructional logic.
Capability inventory: The agent utilizes file system writes, local shell command execution via npm, and browser navigation tools.
Sanitization: There is no mention of sanitization or filtering of the content extracted from the source website before it is used for code generation.
Dynamic Execution of Generated Code: The workflow involves installing dependencies and running npm run dev to launch the generated prototype. Additionally, it calls for running a "preflight script" from the user context. Executing scripts that are dynamically generated or influenced by external data is a security consideration that warrants user oversight.
Broad User Context Access: The skill is instructed to use a wide range of sensitive grounding materials, including codebase paths, design tokens, and Figma files. Users should ensure their local context is appropriate for the task to avoid unintentional exposure during the cloning process.

url-to-code