The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill executes external TypeScript scripts (capture.ts) using the bun runtime from a path computed relative to the skill's installation directory (../../scripts/web-visual-qa/). This relies on a specific directory structure and involves executing code that is not part of the skill's own bundle.
[COMMAND_EXECUTION]: The skill invokes shell commands via bun to perform screenshot capture and baseline operations.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted repository content, including fixtures, reports, and web content. While it includes explicit instructions to ignore embedded commands and treat this data as untrusted, the ingestion of external data combined with the ability to write files and execute scripts creates a vulnerability surface.
Ingestion points: repository files, reports, fixtures, and web content are read during the baseline process as per references/runtime-trust.md.
Boundary markers: The skill contains specific instructions in references/runtime-trust.md stating that embedded instructions cannot alter the skill's scope or authority.
Capability inventory: The skill can execute scripts using bun, write to project files (BASELINES.md), and publish screenshot artifacts.
Sanitization: The skill employs a 'canonical supervisor' for operations and has disable-model-invocation set to true, limiting the agent's autonomous actions.

tailrocks-web-visual-baseline