The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions include the use of the Bash tool for standard development operations, such as creating git backup branches (git checkout -b) and managing project dependencies using npm. These actions are necessary and appropriate for the skill's primary purpose of UI library migration.
[EXTERNAL_DOWNLOADS]: The documentation provides commands to install and uninstall packages from the npm registry, specifically targeting well-known UI libraries such as @radix-ui/react-* and @base-ui/react. These are standard dependencies for the target environment.
[INDIRECT_PROMPT_INJECTION]: The skill involves reading and transforming project source code (JSX and CSS). While this constitutes an ingestion of untrusted data, the skill follows a predefined transformation schema and migration checklist, which minimizes the risk of the agent being misdirected by content within the files it processes.
[SAFE]: Analysis of the skill body, metadata, and reference files found no evidence of prompt injection, obfuscation, hardcoded credentials, or persistence mechanisms. The tool permissions (Read, Write, Bash, etc.) are consistent with the requirements of a code migration utility.

shadcn-migration