The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to automatically execute shell commands (open on macOS or xdg-open on Linux) to launch generated HTML files in the user's browser.
[COMMAND_EXECUTION]: The instructions explicitly tell the agent to attempt to bypass sandbox restrictions ("with the sandbox disabled on the first try") when executing the opening command, as the sandbox might block the required system calls.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It is instructed to read existing files from the current working directory that match its naming pattern (mockup-*.html) and modify them in place. If a file in the workspace contains malicious instructions, the agent will ingest and potentially follow them during the iteration process.
Ingestion points: Reads existing mockup files in the current working directory.
Boundary markers: None specified; the agent reads the raw file content.
Capability inventory: File system writes, file system reads, and command execution (open/xdg-open).
Sanitization: No evidence of input sanitization or validation of the files being read.
[EXTERNAL_DOWNLOADS]: The generated mockups include references to external styling and asset providers, specifically Tailwind CSS, Google Fonts, and iconography via Lucide or Heroicons CDNs.

mockup