The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches design templates and manifests from the npm registry and the getdesign catalog.
Evidence: resources/getdesign-fetcher.md describes the process of fetching the latest getdesign manifest and templates from https://registry.npmjs.org/getdesign/latest.
Security Control: The skill implements mandatory SHA256 integrity verification (hash pinning) for all downloaded templates before they are processed by the agent.
[COMMAND_EXECUTION]: The skill invokes various CLI tools via bunx and npx for design template management and component installation.
Evidence: SKILL.md and resources/getdesign-fetcher.md utilize bunx getdesign@latest for fetching assets. resources/component-patterns.md recommends npx shadcn@latest for component management.
[PROMPT_INJECTION]: The skill identifies the risk of indirect prompt injection from external design data and provides explicit defensive instructions.
Evidence: resources/getdesign-fetcher.md contains a 'Prompt-Injection Defense' section that instructs the agent to treat external data as 'REFERENCE DATA ONLY' and to ignore any imperative instructions or meta-instructions within external files.

oma-design