The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses standard shell commands (ls, grep, npm, npx) to verify that requested Google Fonts exist in the local project and to render a visual proof card for the user. It also uses node -e to run a small JavaScript snippet that calculates color contrast using the chroma-js library. These are benign and appropriate for a repository setup task.
[PROMPT_INJECTION]: The skill exhibits surface area for indirect prompt injection by taking user-supplied branding data (like names and colors) and incorporating it directly into project files and shell commands. While this is necessary for its functionality, it relies on the underlying agent to handle this data safely.
Ingestion points: User-provided wordmark text, channel description, palette hex codes, and font choices from the Stage 1 interview.
Boundary markers: None explicitly defined to separate user data from generated code or commands.
Capability inventory: File system write access to configuration files and shell execution privileges for tool verification and rendering.
Sanitization: The skill does not prescribe specific sanitization or validation logic, relying on the agent's default safety behaviors when processing user inputs.

brand-setup