The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute the Builder.io dev-tools CLI. It provides instructions to quote both the URL and prompt arguments to prevent shell escaping issues.
[REMOTE_CODE_EXECUTION]: Uses npx --yes @builder.io/dev-tools@latest to dynamically download and execute code from the npm registry at runtime. This package is the official tool provided by the skill's authoring organization.
[EXTERNAL_DOWNLOADS]: Fetches the CLI package from the public npm registry. This is standard behavior for the intended functionality of importing prototypes.
[COMMAND_EXECUTION]: The skill interpolates user input into a subprocess call, creating a potential surface for command injection if input is not properly handled by the execution environment.
Ingestion points: The {prompt} variable is populated from user-provided descriptions of what to import from the prototype.
Boundary markers: The command uses double quotes ("{prompt}") to wrap the user-provided input.
Capability inventory: The skill uses the Bash tool to execute arbitrary shell commands.
Sanitization: The skill relies on double-quoting the variable within the shell command but does not specify explicit character filtering or sanitization steps.

import-prototype