The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to execute shell commands provided by the get_charts tool through the assembly.install_command parameter. This is a functional requirement to ensure the correct chart dependencies are installed in the user's environment before code generation.
[EXTERNAL_DOWNLOADS]: The skill retrieves code examples, documentation, and asset metadata from an external MCP server (carbon-mcp). It further enhances security by strictly limiting external asset downloads (fonts, scripts) to the official IBM CDN domain 1.www.s81c.com, explicitly forbidding third-party CDNs like Google Fonts or jsDelivr.
[INDIRECT_PROMPT_INJECTION]: As the skill ingests and processes JSON-formatted data from external tools (code_search, docs_search, etc.), it possesses an attack surface for indirect prompt injection. However, the instructions mitigate this by requiring the agent to parse specific data fields (like example_clean) rather than executing raw strings, and by providing a code_audit tool to verify the output.
[SAFE]: The skill incorporates several security-positive features, including a mandatory code_audit protocol for reviewing generated code and detailed 'Implementation Guardrails' that enforce stable package versions and secure SSR integration patterns.

carbon-builder