The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests design tokens and theme configurations from local files and external sources to generate a React prototype, creating a surface for injection attacks.
Ingestion points: Accesses .claude/design-tokens.json and files within ~/.claude/design-systems/ in the user's home directory, as well as information from user-supplied briefs and external URLs.
Capability inventory: Write, Edit, Bash (cp, mkdir, open), and mcp__chrome-devtools__ tools are available to the skill.
Boundary markers: No specific boundary markers or instructions to ignore embedded instructions in data files are present.
Sanitization: The instructions do not specify any sanitization, validation, or escaping logic for the content read from design tokens before interpolating it into the React source code.
[EXTERNAL_DOWNLOADS]: The skill fetches React, ReactDOM, and Babel libraries from the unpkg.com CDN domain. It utilizes Subresource Integrity (SRI) hashes (integrity attribute) to verify the authenticity of these files, which is a recognized security best practice to prevent supply-chain attacks.
[COMMAND_EXECUTION]: Uses shell commands to perform file system operations, including copying starter files and creating directories. It specifically probes the user's home directory structure (~/.claude/design-systems/) to automatically detect existing design systems.

interactive-prototype