The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local shell commands to scaffold and manage a React project, including npm install, npm run dev, git init, and node scripts for environment checks and data processing.
Evidence: SKILL.md provides instructions to execute environment checks (node --version), scaffold the template (cp), initialize repositories (git init), and manage dependencies/development servers (npm install, npm run dev).
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection as it is designed to ingest and process data from external, user-provided Excel files to generate presentation content.
Ingestion points: The scripts/extract-xlsx.js utility reads data from user-supplied XLSX files.
Boundary markers: Processed data is written to structured JavaScript files within src/data/ for use by the React components.
Capability inventory: The skill has the capability to write files, execute shell commands, and read local project files.
Sanitization: Instructions in SKILL.md and content-rules.md require the agent to write custom extraction logic and verify the integrity of the data (e.g., checking totals) before proceeding.
[SAFE]: The skill utilizes industry-standard, well-known libraries such as React, ECharts, Tailwind CSS, and SheetJS. It refers users to official sources (nodejs.org) for environment setup and includes a functional password gate feature in PasswordGate.jsx that operates locally using a standard string hash and browser local storage without exfiltrating credentials.

vibe-deck