The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches the official @google/design.md package from a trusted organization's repository using npx during validation, export, and diff operations.
[COMMAND_EXECUTION]: Executes project-scoped commands using npx, python3, and bun to perform design linting, contrast checks, and serve local previews.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect injection as it ingests untrusted data from URLs, HTML/CSS, code, and reference images (seen in design.md and identity-assessment.md). It employs boundary markers by explicitly instructing the agent to treat these sources as data and ignore embedded directives. The skill's capabilities include file writing (Write) and command execution (Bash). Sanitization is performed by escaping embedded HTML in the preview views to prevent execution.
[DYNAMIC_EXECUTION]: Runs a local preview server (preview-server.ts) and a contrast checker (check-contrast.py). The preview server is restricted to the local interface (127.0.0.1) and incorporates checks to prevent directory traversal attacks by validating that all file requests stay within the designated session directory.

style-builder