The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection where malicious instructions could be passed to the agent through browser interaction data.
Ingestion points: The agent is instructed in SKILL.md to read $STATE_DIR/events, which is a log file populated by scripts/server.cjs based on user interactions (clicks) in the browser.
Boundary markers: Absent. There are no instructions or delimiters used to warn the agent to ignore instructions embedded in the interaction data.
Capability inventory: The agent has the capability to execute shell scripts (scripts/start-server.sh, scripts/stop-server.sh) and write HTML files to the local file system.
Sanitization: Absent. The server appends raw event data (including text content from clicked elements) to the log file without validation or sanitization.
[COMMAND_EXECUTION]: The skill executes local shell scripts to manage its server environment.
Evidence: SKILL.md directs the agent to run scripts/start-server.sh to initialize the environment and scripts/stop-server.sh to clean up resources.
[DATA_EXFILTRATION]: The skill performs local network operations to facilitate the interactive mockup interface.
Evidence: scripts/server.cjs starts an HTTP and WebSocket server that binds to a local port (defaulting to 127.0.0.1) to serve content to the user's browser.

visual-mockups