The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The BaseLayout.astro component accepts a schema prop (Record or Array) which is rendered directly into the HTML <head> as a JSON-LD block using the set:html directive. This represents a potential surface for indirect prompt injection if the schema data is sourced from untrusted external inputs like a CMS or external API.
Ingestion points: BaseLayout.astro via the schema property.
Boundary markers: None; the component uses set:html to inject stringified JSON directly into a <script> tag.
Capability inventory: The skill facilitates file system inspection (via suggested grep commands for SVG auditing) and network communication through tracking pixels and analytics.
Sanitization: Relies on JSON.stringify for formatting, but does not perform additional HTML entity escaping before raw injection into the page.
[COMMAND_EXECUTION]: The skill includes various CLI command examples for developers to audit site performance, analyze bundle sizes, and manipulate font assets.
Evidence: Bash scripts for batch Lighthouse testing in SKILL.md and references/testing.md.
Evidence: Usage of npx source-map-explorer for JavaScript bundle analysis in references/bundle-size.md.
Evidence: grep command to identify SVG images missing explicit dimensions in references/cls-prevention.md.
Evidence: npx glyphhanger command for font subsetting and optimization in references/fonts.md.
[EXTERNAL_DOWNLOADS]: The skill incorporates and manages standard third-party tracking and analytics services.
Evidence: Fetches Google Tag Manager scripts from www.googletagmanager.com.
Evidence: Fetches Facebook Pixel from connect.facebook.net.
Evidence: References scripts from well-known services including CookieYes (cdn-cookieyes.com) and Cloudflare Insights (static.cloudflareinsights.com).

astro-performance