The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to run npx -y dembrandt@0.39.2, which downloads and executes a design token extraction tool from the NPM registry. NPM is a well-known and standard package registry.
[COMMAND_EXECUTION]: The skill utilizes command-line tools for its core functionality, specifically executing npx to run the dembrandt utility and python3 to run internal validation scripts.
[DYNAMIC_EXECUTION]: The test script scripts/test_check_tokens.py uses subprocess.run() to programmatically execute the scripts/check_tokens.py script. This is a controlled execution of the skill's own components for testing and validation purposes.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it processes content from external websites (via dembrandt and Playwright) and analyzes local plugin source code. Malicious instructions hidden in these sources could potentially influence the agent's behavior during analysis.
Ingestion points: Raw HTML/CSS content from user-provided URLs and source code from local plugin directories (e.g., .css, .js, .tsx files).
Boundary markers: The instructions do not specify the use of clear delimiters or guardrails to prevent the agent from interpreting data as instructions.
Capability inventory: The skill has the ability to read local files, execute shell commands (via npx), and perform network requests (via Playwright/dembrandt).
Sanitization: There is no evidence of sanitization for the data extracted from external websites before it is processed by the agent.

design-system