The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the @plannotator/tot package from the npm registry using npm install -g. It also utilizes Google's official design system tools via npx @google/design.md for validation purposes.
[DATA_EXFILTRATION]: The skill uses the tot CLI to publish local HTML artifacts to a public web service (tot.page). Although the instructions require user consent, this functionality involves uploading local project design data and content to an external remote server.
[COMMAND_EXECUTION]: The skill executes various shell commands for package management, design system linting, and artifact publishing. Specifically, it uses npm install, npx, and the tot binary.
[REMOTE_CODE_EXECUTION]: The skill invokes remote code through npx @google/design.md and the installation of the @plannotator/tot package, which is subsequently executed as a CLI tool.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from local workspace files (CSS, design tokens, components) and remote URLs to document design systems, creating a vulnerability surface for indirect prompt injection.
Ingestion points: Reads project files in references/understand/index.md and extracts data from external URLs in references/understand/url-and-validation.md.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings for the data being processed.
Capability inventory: File system writing, network communication via the publishing tool, and shell command execution.
Sanitization: There are no explicit filtering or sanitization measures defined for the content extracted from external sources.
[DYNAMIC_EXECUTION]: The prototype picker harness in references/vary/picker.md uses innerHTML to dynamically render HTML content from variant functions into the DOM, which is a form of local dynamic code execution.

pe-design