The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on several command-line utilities to perform project validation, visual audits, and code analysis:
npx trunative is executed with various subcommands: doctor (to verify project health), install, rubric (to generate checklists), and detect (to scan for source code issues).
adb (Android Debug Bridge) is used to capture screenshots from Android emulators (adb exec-out screencap) and simulate system behaviors like process termination (adb shell am kill).
xcrun simctl is used to capture screenshots from the iOS simulator environment.
Headless browser commands (e.g., chrome --headless) are used to render HTML wireframes into PNG images for visual review.
[EXTERNAL_DOWNLOADS]: The skill uses npx to execute external packages. While @google/design.md is from a well-known trusted vendor, trunative is a specialized tool for the framework this skill supports.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection because its core functionality involves reading and following instructions found in project-specific files:
Ingestion points: Project documentation files (PRODUCT.md, DESIGN.md, STACK.md, and screen briefs in .trunative/screens/*.md) and the application source code itself.
Boundary markers: Absent. The instructions do not define delimiters or specific "ignore instructions" markers for the content being analyzed.
Capability inventory: The skill can execute shell commands, read/write local files, and interact with simulators/emulators.
Sanitization: Absent. There is no evidence of filtering or sanitizing the content of the project files before the LLM processes them.
[DYNAMIC_EXECUTION]: The skill dynamically generates HTML wireframe files (.wireframe.html) and then executes/renders them using a headless browser to produce image artifacts.

trunative-swiftui