The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external project files (such as package.json, components.json, and lockfiles) to determine the choice of command runner and UI primitive.
Ingestion points: package.json, components.json, src/, components/, app/, and lockfiles (bun.lockb, pnpm-lock.yaml, yarn.lock, package-lock.json).
Boundary markers: None present; the agent is not instructed to disregard instructions potentially embedded in these source files.
Capability inventory: The skill has access to Read, Glob, Grep, and Bash tools.
Sanitization: The instructions do not specify any validation or sanitization of the values extracted from the project files before they are used to construct shell commands.
[REMOTE_CODE_EXECUTION]: The workflow suggests using detected runners to execute shadcn@latest from a remote registry.
Evidence: The template detection-script.md includes the pattern ${result.runner} shadcn@latest add button. Executing unpinned @latest packages introduces a supply chain risk if the package registry or the specific package is compromised.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to execute a local detection script.
Evidence: SKILL.md allows the Bash tool, and detection-script.md provides an example: bash /path/to/plugins/shadcn-expert/scripts/detect-primitive-lib.sh. The security of this operation depends on the integrity of the external script located on the user's filesystem.
[EXTERNAL_DOWNLOADS]: The skill identifies and uses package managers to fetch dependencies.
Evidence: Step 5 of the detection algorithm identifies the lockfile to determine whether to use bunx, npx, pnpm dlx, or yarn dlx for downloading and running CLI tools.

shadcn-detection