The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill includes a mechanism in package-build.mjs and lib/previews.mjs to load JavaScript module overrides from the repository's .design-sync/overrides/ directory. If these files exist, they are imported and executed using import().
[DYNAMIC_EXECUTION]: The validation script package-validate.mjs attempts to verify the generated component bundle by running new Function(src), where src is the content of the bundled JavaScript. This causes the bundle's code to be executed within the agent's process.
[COMMAND_EXECUTION]: The skill performs multiple shell command executions, including npm build, npx storybook, and npx playwright. It also dynamically installs Node.js dependencies (esbuild, ts-morph, playwright) at runtime in a local directory (.ds-sync/).
[INDIRECT_PROMPT_INJECTION]: The skill processes repository content such as markdown documentation (.md, .mdx) and code comments to synthesize component prompts. While the skill contains explicit instructions to ignore directives found within this external data, the ingestion of untrusted repository content into the agent's context creates a potential attack surface.
[SAFE]: The skill starts a local HTTP server using lib/storybook/http-serve.mjs to facilitate human review of components. The server implementation includes checks to prevent directory traversal and restricts access to the specified output directory.

design-sync