The Agent Skills Directory

[DYNAMIC_EXECUTION]: The snapshot.ts utility implements an --auth-script feature that dynamically loads and executes a local JavaScript or TypeScript module using the import() function. This is designed to allow users to provide custom logic for bypassing authentication walls during the snapshot process.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute multiple shell commands using npx tsx to run internal scripts such as snapshot.ts, extract_inline_html.ts, and post_process.ts. This requires the environment to have Node.js and the tsx runner available.
[EXTERNAL_DOWNLOADS]: The extract_inline_html.ts script performs outbound network requests to fetch remote images referenced in JSX or HTML source files for base64 inlining. It includes a safety check (isSafeUrl) that attempts to block requests to private network ranges and localhost to mitigate SSRF risks.
[EXTERNAL_DOWNLOADS]: The snapshot.ts script uses Puppeteer to navigate to user-specified URLs. During the snapshot process, it fetches various external resources, including images, stylesheets, and fonts, and loads the Tailwind CSS CDN script (https://cdn.tailwindcss.com).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted web content via Puppeteer and parses React components via Babel. While the scripts include logic to remove <script> tags and other interactive elements from the final output, rendering arbitrary HTML/JSX carries an inherent risk of indirect instruction injection if the output is further processed by an LLM.

stitch::extract-static-html