The Agent Skills Directory

[COMMAND_EXECUTION]: Uses the @21st-dev/cli to manage UI assets, involving shell commands for searching, pulling code, and modifying environment configurations (e.g., 21st init --write, 21st install-skill).
[EXTERNAL_DOWNLOADS]: Retrieves component code, theme CSS, and SVG logos from the 21st.dev registry and the svgl.app library during normal operation.
[REMOTE_CODE_EXECUTION]: The 21st add command facilitates the installation of React components and their respective NPM dependencies directly into the user's project, and uses npx to execute the CLI tool from the remote NPM registry.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion point for external data from the 21st.dev registry, which could potentially host malicious instructions designed to be processed by the AI agent during code retrieval or installation.
Ingestion points: Registry content retrieved via the search, get, and theme commands documented in SKILL.md.
Boundary markers: Absent. The skill lacks instructions to the agent to delimit or treat registry-provided content as untrusted input.
Capability inventory: Includes the ability to write files to the local file system (components/ui/) and execute shell commands for dependency installation (SKILL.md).
Sanitization: Absent. No validation or filtering logic is specified for registry content prior to installation or display.

21st-cli-use