The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/add-component.sh utility uses unquoted here-docs (<< EOF) to interpolate user-controlled variables (NAME, DESCRIPTION) into file content. This configuration allows for shell command substitution (e.g., $(...)), which can be triggered if the agent executes the script using malicious input received from a user.
[COMMAND_EXECUTION]: Scripts including scripts/search-library.sh, scripts/get-component.sh, and scripts/list-components.sh process user-provided strings through standard shell commands like find, grep, and sed without using the -- end-of-options delimiter or sanitizing the input. This introduces a vulnerability to argument injection where input starting with a hyphen can alter command behavior.
[PROMPT_INJECTION]: The skill's 'ULTRATHINK' mode establishes a behavioral override that instructs the agent to ignore standard operational constraints like brevity. Such protocols can be exploited to manipulate the agent's internal reasoning or bypass safety filters.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its component library system. Ingestion points: Data enters the environment via scripts/add-component.sh which writes to markdown files in the library/ directory. Boundary markers: The generated component files do not use clear delimiters or instructions to ignore embedded commands. Capability inventory: The skill includes scripts capable of arbitrary file read/write and shell execution. Sanitization: There is no evidence of input escaping or validation for content stored in the library, allowing malicious instructions to persist and later influence agent behavior.
[EXTERNAL_DOWNLOADS]: The documentation references well-known registries and libraries (NPM, Radix UI, Framer Motion, GSAP). It also suggests the use of the ls-libraries package via npx, which is a low-reputation package that should be verified before use.

Avant-Garde Frontend Architect