The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several internal Python and Node.js scripts to perform its core tasks. For instance, scripts/generate_system_preview.py creates temporary HTML previews of design candidates, and scripts/detect-antipatterns.mjs performs automated design audits.
[COMMAND_EXECUTION]: Static analysis detected the use of subprocess.run() in scripts/test_compute_contrast.py (referenced in the metadata), which is used for executing shell commands during testing of the contrast calculation logic.
[EXTERNAL_DOWNLOADS]: The skill's instructions guide the agent to connect to an external Model Context Protocol (MCP) server at https://designlib.app-builders.club/mcp to retrieve curated design tokens, styles, and palettes. This is a known resource provided by the skill's author.
[DATA_EXFILTRATION]: The skill's auditing features, particularly the /review command, involve the agent navigating to user-provided URLs using browser automation tools like Puppeteer and Playwright to capture page content for analysis. While this involves network requests to external domains, it is consistent with the skill's auditing function.
[PROMPT_INJECTION]: The design auditing process represents an indirect prompt injection surface as it ingests untrusted data from the web.
Ingestion points: The agent retrieves content from remote URLs provided by the user (SKILL.md).
Boundary markers: The skill does not explicitly define delimiters to separate the untrusted remote content from its own instructions.
Capability inventory: The skill can write files and execute local scripts as part of the app-building process (SKILL.md, scripts/detect-antipatterns.mjs).
Sanitization: There is no evidence of explicit sanitization or filtering of the text content extracted from the audited pages before it is processed by the agent.

design