The Agent Skills Directory

[SAFE]: The skill utilizes the @google/design.md package for linting design tokens. References to tools and documentation from the Google organization are considered safe for development workflows.
[SAFE]: The instructions include proactive security guidance, such as isolating wallet connections, avoiding the embedding of private keys in generated code, and ensuring that RPC URLs are managed through environment variables rather than hardcoded secrets.
[INDIRECT_PROMPT_INJECTION]: The skill processes external design data from the Stitch platform and project-specific DESIGN.md files. This constitutes an ingestion point for untrusted data. However, the skill provides a clear quality checklist and relies on standard frontend frameworks, which reduces the risk of accidental execution of embedded instructions.
[COMMAND_EXECUTION]: The skill uses the Bash tool to run design linters and scaffold projects using vite. These commands use static filenames and standard industry tools, posing no identified risk of command injection.

react-vite-dashboard