The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The maintenance script (scripts/check-updates.py) fetches version metadata from the official npm registry (registry.npmjs.org). This is a legitimate operation for verifying documentation accuracy.
[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute the shadcn CLI using npx, allowing it to initialize project configurations and manage component installation.
[INDIRECT_PROMPT_INJECTION]: The skill documents the tool's ability to install components from external URLs. This introduces a surface where a user-provided URL could lead to the download of untrusted content. 1. Ingestion points: Command examples in SKILL.md and references/01-cli.md accepting URLs. 2. Boundary markers: No explicit instructions for URL validation are provided. 3. Capability inventory: Shell execution via npx. 4. Sanitization: None provided for external registry URLs.
[SAFE]: No malicious behavior, obfuscation, or data exfiltration was identified.

shadcn-ui