The Agent Skills Directory

[SAFE]: The skill is primarily instructional and contains markdown templates for documenting UI components. No evidence of prompt injection, data exfiltration, or malicious command execution was found.- [INDIRECT_PROMPT_INJECTION]: The skill includes an automation script (generate-docs.ts) that processes external data from a tokens.json file. While this represents a surface for indirect prompt injection if the source data is compromised, the risk is minimal and consistent with the skill's primary purpose of generating static documentation.
Ingestion points: tokens.json is read by the script.
Boundary markers: None present in the generated output files.
Capability inventory: The script uses fs.readFileSync and fs.writeFileSync for local file operations.
Sanitization: No explicit sanitization of JSON values is performed before interpolation into markdown.

token-docs