The Agent Skills Directory

[SAFE]: The skill's behavior is entirely consistent with its stated purpose of generating UI components for Next.js projects. It identifies the tech stack by reading standard project files like package.json and tsconfig.json, which is a functional requirement.
[EXTERNAL_DOWNLOADS]: The illustrated.jsx template references a background image hosted on Unsplash (images.unsplash.com). Unsplash is a well-known service for public assets and does not represent a security risk.
[DATA_EXFILTRATION]: While the skill reads project configuration files to determine the tech stack (e.g., detecting Tailwind CSS or Material UI), it does not attempt to access sensitive directories such as .ssh, .aws, or .env files, nor does it send any project data to external servers.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from local configuration files (like tailwind.config.js or globals.css) to match theme tokens. This is a standard architectural pattern for code generators. The risk is minimized by the skill's specific focus on extracting design tokens (colors, font families) rather than executing logic from these files.
[COMMAND_EXECUTION]: The skill does not execute any shell commands or subprocesses. It purely performs file read operations for discovery and file write operations for code generation.

nothify