The Agent Skills Directory

[COMMAND_EXECUTION]: The prompts/scraper.md file provides a Bash command template for executing headless Chrome that directly incorporates {url} and {slug} placeholders. This pattern is vulnerable to shell command injection if the agent executes the string without proper escaping or validation of user-provided arguments.
[DATA_EXFILTRATION]: The scraping logic utilizes headless browsers (Chrome, Playwright, BrowserUse) which, if not configured with strict protocol restrictions, may be manipulated into accessing sensitive local files via file:// or other internal network resources if provided with a malicious URL. This poses a data exposure risk.
[PROMPT_INJECTION]: The skill's primary function involves scraping external websites and passing the extracted data (Phase 2) to an 'Analyzer' prompt. This creates a substantial surface for indirect prompt injection, as malicious instructions hidden within a target website's DOM or text could attempt to override the agent's instructions during the analysis phase.
Ingestion points: Scraped DOM, CSS variables, computed styles, and page metadata from target URLs (prompts/scraper.md).
Boundary markers: The prompt files lack clear delimiters or specific instructions to the agent to treat scraped content strictly as data or to ignore any directive-like text found within the external content.
Capability inventory: The agent environment is highly capable, possessing tools for filesystem modification (Write, Edit), network access (WebFetch, WebSearch), and shell execution (Bash).
Sanitization: There is no evidence of content sanitization or instruction-filtering before the scraped data is interpolated into the analysis prompts.

design-distiller