The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches SVG icons and design assets from established public repositories on GitHub, including those maintained by Lucide, Tailwind Labs (Heroicons), Tabler Icons, Feather Icons, and Simple Icons. These are well-known services for UI design components.
[COMMAND_EXECUTION]: The instructions describe the execution of a local script, scripts/fetch-page.js, using Node.js to retrieve and process web content from sites like CodePen and UIVerse. This is standard tool usage for its stated purpose of design resource extraction.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it retrieves and processes untrusted data from external websites to be presented to the agent.
Ingestion points: Data is fetched from third-party URLs (e.g., CodePen, UIVerse, or arbitrary sites matching search results) using Playwright-based browser rendering or direct HTTP requests.
Boundary markers: The skill uses Markdown code blocks as delimiters when presenting results to the agent or user.
Capability inventory: The skill utilizes node execution for its extraction script and can perform network requests to any search-indexed site.
Sanitization: The guidelines instruct the agent to "clean up extracted code" by removing vendor prefixes and unrelated styles, which serves as a basic manual sanitization step.

finding-design-resources