The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various system commands and tools for its operation, including ego-browser for web rendering, test-by-maestro for mobile interaction, and rsync or scp for syncing audit artifacts from remote hosts. These tools are documented parts of the skill's dual-engine capture pipeline.
[DYNAMIC_EXECUTION]: The validate-capture-gate.sh utility script executes a hardcoded Python script via python3 -c to perform deep CRC and chunk validation on captured PNG images. This ensures file integrity before visual evaluation.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted visual data from external websites and applications, which constitutes an indirect prompt injection surface.
Ingestion points: Untrusted PNG screenshots enter the agent context via visual tools as documented in references/vision-air-gap.md.
Boundary markers: The skill explicitly uses <AIR_GAP_SYSTEM_BOUNDARY> delimiters to isolate subagents and instruct them to ignore any non-visual context, as seen in references/execution-modes.md.
Capability inventory: The skill utilizes invoke_subagent for parallel evaluation and shell tools for file synchronization and validation.
Sanitization: The validate-capture-gate.sh script (Phase 2) validates all visual assets to prevent the processing of corrupt or malformed files.

audit-ui-ux