The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions and documentation (in SKILL.md and interface-quality.md) direct the agent to execute a bundled Python script (scripts/inspect_html.py) for auditing HTML source code. This is an intended feature for structural and accessibility checks.
[DYNAMIC_EXECUTION]: The test suite (tests/test_inspect_html.py) uses importlib.util to dynamically load the inspection script for unit testing. This is a standard and safe practice within a development and testing context for Python utilities.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external HTML files, which constitutes an indirect prompt injection surface. The risk is mitigated by the skill's workflow, which uses a specialized parser to generate structured JSON reports rather than having the agent process raw untrusted content as authoritative instructions.
[SAFE]: The Python utility script (scripts/inspect_html.py) is a read-only HTML parser using the standard library. It excludes sensitive directories like .git and node_modules from its scan and does not perform network operations or execute parsed content.

ui-design