The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes untrusted visual data from external websites.
Ingestion points: The scripts/capture.py script navigates to and screenshots a user-provided DEV_URL.
Boundary markers: The analysis prompts in scripts/analyze.py lack explicit instructions to ignore or treat text found within screenshots as untrusted content.
Capability inventory: The skill allows the agent to execute shell commands (python3, cat) and uses the view tool to process visual information.
Sanitization: There is no sanitization or filtering of the visual content captured from the target URL before it is analyzed by the vision model.
[EXTERNAL_DOWNLOADS]: The scripts/capture.py script uses the Playwright library to navigate to arbitrary URLs. This behavior allows for network operations to non-whitelisted domains, which could be leveraged for Server-Side Request Forgery (SSRF) if the execution environment has access to sensitive internal services or cloud metadata endpoints (e.g., 169.254.169.254).

ui-review