The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and processing untrusted third-party data from external websites (HTML, CSS, JS, and screenshots). This creates an attack surface for indirect prompt injection if a target website contains malicious directives designed to override the agent's behavior.
Ingestion points: External content is fetched via tools and stored in .clone-ui/source/ files such as raw.html and rendered.html.
Boundary markers: The instructions explicitly direct the agent to treat this content as untrusted data rather than instructions, suggesting a mental boundary of <UNTRUSTED_EXTERNAL_CONTENT>.
Capability inventory: The agent has the ability to execute shell commands via helper scripts, perform network requests via browser automation, and spawn sub-agents for verification.
Sanitization: The skill implements a 'Hard guardrail' requiring the agent to scan all external content for injection patterns (such as 'ignore previous instructions' or shell commands) and halt execution if they are detected in a directive context.
[COMMAND_EXECUTION]: The skill uses local helper scripts (save-tool-result.ps1 and save-tool-result.py) to manage large JSON payloads from tool results. These are executed via the shell (pwsh or python). The documentation suggests that users manually add these scripts to their agent's permission allow-list to facilitate the workflow.
[DYNAMIC_EXECUTION]: The skill utilizes an adversarial sub-agent (Agent() call) during its verification phase to perform an independent audit of the cloned output. It also relies on evaluate_script calls via browser automation to interact with and extract data from live web pages.

clone-ui