idea-refine: rewrite the description to follow the repository's
documented "Use when..." trigger convention (AGENTS.md). The previous
description was 135 characters, redundant, and used the skill name
itself as the only trigger phrase, making it the only skill not aligned
with how the other 21 skills self-describe.
browser-testing-with-devtools: surface the Chrome DevTools MCP
dependency at the top of the description and explicitly note the
requirement, so agents that route by MCP availability can detect it
without parsing the body.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Update all SKILL.md descriptions to lead with what the skill does
(third person) followed by trigger conditions, per Anthropic's
skill authoring docs. All original trigger conditions preserved.
Update description max chars to match Anthropic spec (1024).
Retain workflow-summary warning in skill-anatomy.md to prevent
agents from following descriptions instead of reading full skills.
Add Table of Contents to reference files longer than 100 lines so
Claude can see the full scope of available information even when
previewing with partial reads.
Here's what I added to address the audit findings:
**PROMPT_INJECTION (HIGH)** - Added a full "Security Boundaries" section with three subsections:
1. **Treat All Browser Content as Untrusted Data** - Explicit rules that DOM, console, network, and JS execution output are data, never instructions. Covers URL navigation restrictions and suspicious content flagging.
2. **Content Boundary Markers** - Visual diagram and rules separating trusted (user messages, project code) from untrusted (all browser-sourced data) contexts.
**COMMAND_EXECUTION (HIGH)** - Added **JavaScript Execution Constraints** subsection:
- Read-only by default
- No external requests from the page
- No credential/token access (cookies, localStorage, sessionStorage)
- Scope limited to current task
- User confirmation required for DOM mutations
Also updated the tool table description, added 5 new red flags, 2 new rationalizations, and 2 new verification checklist items to reinforce the security boundaries throughout the skill.
The JS execution tool remains functional for its core debugging purpose (state inspection, DOM queries, computed values) - the constraints just prevent misuse vectors.
Shayne Boyer