The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script (suggest_next_skill.py) located in the .agents directory to manage project workflow. This is a vendor-provided tool used to suggest subsequent actions after the current task is complete.
[DYNAMIC_EXECUTION]: The file scripts/_skill_cli.py contains a utility function run_command that utilizes subprocess.run to execute system commands. While intended as a helper for vendor-specific scripts, it provides a capability for process execution on the host environment.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves reading and transforming user-provided CSS and Vue files. This creates a surface where instructions embedded in those external files (e.g., within code comments) could potentially influence the agent's behavior.
Ingestion points: User-provided source files including src/assets/design-tokens.css, src/main.js, and various .vue components.
Boundary markers: The instructions do not define specific delimiters or warnings for the agent to ignore instructions found within the code it is processing.
Capability inventory: The agent is instructed to execute local scripts and has access to a subprocess.run wrapper for system-level execution.
Sanitization: The skill does not implement explicit sanitization or filtering of instructions that might be present in the user-controlled code content.

aura-design-tokens