The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the execution of local Python scripts, specifically scripts/search.py, to query its internal database. These scripts are provided within the skill package and do not perform any network operations or access sensitive system files.
[PRIVILEGE_ESCALATION]: The SKILL.md file provides environment setup instructions that suggest using sudo apt install on Linux distributions to install the Python runtime if it is missing. These are standard administrative instructions for environment configuration and are not executed silently by the skill logic itself.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface where user-provided keywords are used to filter and rank design guidelines from its internal CSV files. While this creates a surface for indirect prompt injection, the risk is minimized as the data source is static and local to the skill.
Ingestion points: User input provided as a search query to scripts/search.py (e.g., product type, industry, or keywords).
Boundary markers: Search results are explicitly delimited within ASCII-formatted boxes or Markdown blocks to separate tool output from the agent's reasoning.
Capability inventory: The skill primarily reads its own CSV data and executes internal Python logic; it lacks network access or broad file system write permissions.
Sanitization: The BM25.tokenize method in scripts/core.py performs basic sanitization by converting input to lowercase and removing non-word/non-whitespace characters using regular expressions.

ui-ux-pro-max