The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the 21st CLI and npx to search, retrieve, and install components.
[EXTERNAL_DOWNLOADS]: The skill downloads the @21st-dev/cli tool from the npm registry and fetches component code, themes, and templates from the 21st.dev domain.
[REMOTE_CODE_EXECUTION]: The 21st add command and the suggested npx shadcn alternative download and execute component installation scripts directly from remote URLs (e.g., https://21st.dev/r/<user>/<slug>). While these are vendor-owned resources, they involve executing remote content on the local system.
[CREDENTIALS_UNSAFE]: The documentation identifies ~/.config/21st/auth.json as the file path where session tokens are stored. It also describes the format for API keys (21st_sk_…) and environment variables (TWENTYFIRST_TOKEN, API_KEY_21ST), which could be targeted by a malicious user for exfiltration.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface due to its capability to process untrusted data from an external catalog.
Ingestion points: External component code, CSS, and metadata are retrieved from the 21st.dev catalog through commands like 21st get and 21st search.
Boundary markers: The instructions do not specify any delimiters or safety markers to isolate the downloaded code from the agent's control flow.
Capability inventory: The tool has the ability to write files to the filesystem (components/ui/) and trigger the installation of npm dependencies.
Sanitization: There is no evidence of sanitization, validation, or filtering of the remote content before it is integrated into the local project.

21st-cli-use