The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands to execute a bundled Python script (scripts/search.py) for processing UI/UX queries and managing design data.
[PERSISTENCE]: The skill includes a feature to save design systems to the local filesystem. The persist_design_system function in scripts/search.py creates a design-system/ directory and writes markdown files to store project state across multiple interactions.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled inputs (such as industry keywords and page names) which are passed as command-line arguments to a local script that performs file operations.
Ingestion points: The query and --page arguments in SKILL.md are derived from user requests and passed to scripts/search.py.
Boundary markers: None present; user input is interpolated directly into shell commands.
Capability inventory: The script has the capability to write files (Path.write_text) and create directories within the local workspace.
Sanitization: The script lacks sanitization for the page argument. This creates a potential path traversal vulnerability where a specially crafted page name (e.g., using ../ sequences) could allow the agent to write markdown files outside the intended design-system directory.

ui-ux-pro-max