The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a bash command python3 .claude/skills/ordinary-interfaces/scripts/project-system.py $ARGUMENTS that directly interpolates the $ARGUMENTS variable without quoting or sanitization. This allows for potential command injection if a user provides input containing shell metacharacters (e.g., ;, &, |), leading to arbitrary code execution.
[EXTERNAL_DOWNLOADS]: The instruction to run npx shadcn@latest info --json causes the agent to download and execute the latest version of the shadcn package from the NPM registry. NPM is a well-known and established package registry service.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process local project files (token families, scales, breakpoints) to report on the project system. This creates a surface for indirect prompt injection if those files contain malicious instructions.
Ingestion points: Files within the path provided in $ARGUMENTS (SKILL.md).
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore embedded commands within the project data.
Capability inventory: The skill has access to bash execution, file reading, and network access (via npx).
Sanitization: There is no evidence of sanitization or validation of the ingested project content.

read-project