The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The fe-gate.sh script executes npx -y impeccable@3.6.1, which downloads and runs a package from the npm registry at runtime.
[DYNAMIC_EXECUTION]: The fe-gate.sh script uses the node -e flag to execute a JavaScript string that parses JSON output and writes results to a file. While the code string is fixed, this pattern constitutes dynamic execution.
[DYNAMIC_EXECUTION]: The viewport-check.mjs script utilizes createRequire and import.meta.url to dynamically resolve and load the playwright package from the local environment.
[COMMAND_EXECUTION]: The skill frequently executes shell scripts and CLI tools, including python3 for design synchronization and bash for orchestration of the quality gate.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external URLs via the Hallmark study <URL> command (Route C), which could introduce malicious instructions from external web content into the agent's context.
Ingestion points: External websites retrieved and analyzed during the intake phase in references/intake.md.
Boundary markers: The skill documentation mentions a "refuse list" and "Remote URL Safety" protocol used by the underlying Hallmark utility to mitigate risks.
Capability inventory: The skill can write to the local file system (design.md, tokens.css, fe-gate.report.json), execute shell commands, and interact with a headless browser (playwright).
Sanitization: Content sanitization is managed by the external Hallmark tool; no additional sanitization logic is present in the local skill scripts.

prd-grade-fe