The Agent Skills Directory

[SAFE]: No significant security issues were detected. The skill demonstrates good security posture by explicitly instructing the agent to exclude credentials from generated artifacts and providing guidance on secure API key management.
[COMMAND_EXECUTION]: The skill executes a local Node.js script (capture-sections.js) to automate the screenshot capture process. The script uses Puppeteer with the --no-sandbox flag; while this disables a layer of browser isolation, it is a standard configuration for running headless browsers in many restricted or containerized environments.
[EXTERNAL_DOWNLOADS]: The skill performs a local npm install to set up its required automation dependencies (Puppeteer and Sharp). These are well-known packages fetched from the official NPM registry.
[PROMPT_INJECTION]: The skill includes a potential surface for indirect prompt injection, as it is instructed to browse external websites for current information to populate the showcase content.
Ingestion points: External websites accessed via the agent's browsing capability in Step 2 of the Workflow.
Boundary markers: Absent from the content generation instructions.
Capability inventory: The skill can execute local scripts and write files to the project's assets directory.
Sanitization: No specific sanitization or filtering of external content is described before it is integrated into the showcase content.

show-off