The Agent Skills Directory

[SAFE]: The skill implements a robust 'Untrusted Content Boundary' for data captured from websites (such as DOM snapshots and accessibility trees). This ensures that the agent treats captured page content as data rather than instructions, providing a key mitigation against indirect prompt injection.
[SAFE]: The skill explicitly avoids privilege escalation by refusing to run sudo commands and instead instructing the agent to prompt the user to install necessary system-level dependencies manually via their package manager.
[COMMAND_EXECUTION]: Installs and uses well-known, legitimate Node.js packages including playwright, pixelmatch, and pngjs. These are standard, reputable tools for browser automation and image comparison in development workflows.
[COMMAND_EXECUTION]: Employs standard local development commands (e.g., npx serve, npx @11ty/eleventy) to build and serve sites for screenshotting, which is entirely consistent with its stated purpose of testing localhost environments.
[SAFE]: Encourages secure credential management by using environment variables (e.g., process.env.DEMO_USER) rather than hardcoding sensitive information in its template scripts.

localhost-screenshots