The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill captures structured data from websites (ARIA snapshots, DOM, interactive maps), which creates an indirect prompt injection surface if the content is attacker-controlled.
Ingestion points: Data is ingested through Playwright APIs like locator.ariaSnapshot() and page.evaluate() in assets/scripts/screenshot-a11y.js and other templates.
Boundary markers: The skill implements a untrusted-page-content envelope for JSON and HTML output to explicitly mark data as untrusted.
Capability inventory: Capabilities include file system writes (fs.writeFileSync), network access (Playwright), and subprocess management (child_process.spawn).
Sanitization: Instructions include stripping script tags and event handlers from DOM snapshots before they are saved.
[EXTERNAL_DOWNLOADS]: The skill requires downloading standard industry tools and libraries from the npm registry.
Downloads include playwright@1.62.0, pixelmatch@7.2.0, and pngjs@7.0.0.
These packages are well-known and originate from reputable sources.
[COMMAND_EXECUTION]: The skill uses shell commands for environment setup and infrastructure management.
Uses npm install for dependency setup and child_process.spawn to manage local development servers.
[DATA_EXFILTRATION]: The skill handles sensitive browser session data for persistent workflows.
Stores Playwright storageState (containing cookies and origin storage) in the user's cache directory (e.g., ~/.cache/localhost-screenshots).
The documentation provides specific guidance on securing this data and excluding it from repositories.

localhost-screenshots