The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection.
Ingestion points: Untrusted data is ingested from external URLs provided in the target_url input via browser_navigate, browser_snapshot, and browser_evaluate scripts as defined in SKILL.md.
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands when processing extracted DOM or accessibility content.
Capability inventory: The agent utilizes browser automation tools (browser_navigate, browser_click, browser_evaluate), state management (state_write), and shell command execution (npx serve, python3).
Sanitization: There is no explicit sanitization of the extracted web content before it is passed to the LLM for code generation.
[REMOTE_CODE_EXECUTION]: The skill implements a workflow where code is generated from untrusted web content and subsequently executed in a local browser environment during the verification phase (Step 4). This could allow malicious scripts from the target website to execute locally.
[COMMAND_EXECUTION]: The skill uses shell commands to host the generated clone locally for testing purposes using npx serve or python3 -m http.server as documented in SKILL.md.
[EXTERNAL_DOWNLOADS]: The skill recommends downloading and configuring the @playwright/mcp package from the official npm registry. This is a well-known service and the dependency is required for the skill's core functionality.

web-clone