The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, including HTML, CSS, and JS source files, as well as live web pages via browser automation. This creates a significant surface for indirect prompt injection attacks where malicious instructions embedded in the project being reviewed could attempt to hijack the agent's behavior.
Ingestion points: Reads project source files (HTML, JSX, TSX, Vue, Svelte), configuration files (.impeccable.md, .github/copilot-instructions.md, package.json), and navigates to live URLs via browser automation.
Boundary markers: The instructions lack explicit delimitation or warnings to the agent to ignore instructions embedded within the data being critiqued.
Capability inventory: The skill utilizes file system access (read), browser automation (navigation, tab creation, JavaScript execution via document.title), sub-agent delegation, and shell command execution.
Sanitization: There is no mention of sanitizing or escaping the content of the files or pages before they are processed by the LLM or sub-agents.
[COMMAND_EXECUTION]: In Step 2 (Assessment B), the instructions tell the agent to "run it" if the project has a linting or design-check tool configured in package.json. If an agent is asked to critique a malicious or compromised repository, this could lead to the execution of arbitrary shell commands defined by an attacker in the scripts section of the project's package.json.
[DYNAMIC_EXECUTION]: The skill uses browser automation to execute JavaScript snippets (e.g., document.title = '[LLM] ' + document.title;) within the context of the live page being analyzed. While currently limited to title changes, the presence of browser-based script execution on untrusted pages is a security consideration.
[EXTERNAL_DOWNLOADS]: The skill directs the agent to use browser automation to visually inspect live pages. While necessary for the skill's primary purpose, this involves fetching and rendering external, untrusted content from URLs provided by the user or found in the project.

critique