The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by scanning local .vue source files within the project root to extract design patterns. This creates an attack surface where malicious comments or strings in the code could attempt to influence the agent's output.
Ingestion points: Files are read in scripts/scan_patterns.py and scripts/diff_violations.py using Path.read_text.
Boundary markers: The data is emitted as structured JSON, providing a clear boundary between the tool output and the agent's instructions.
Capability inventory: The scripts have file-read access; a dormant subprocess.run capability exists in scripts/_skill_cli.py.
Sanitization: High. The scripts use restrictive regular expressions (TOKEN_RE, HEX_RE, PRIMEVUE_RE, CLASS_RE) to filter the file content, significantly reducing the likelihood of successful prompt injection.
[COMMAND_EXECUTION]: The shared utility file scripts/_skill_cli.py contains a run_command function that uses subprocess.run. Although this function is not currently called by the tools defined in the manifest, it represents a pre-existing capability for executing system commands. The implementation follows security best practices by setting shell=False and resolving executables via shutil.which to prevent command injection.
[PROMPT_INJECTION]: The skill includes comprehensive stylistic instructions in context/PROSE_ANTI_SLOP.md. These are framing instructions designed to enforce a specific professional persona and brand voice (e.g., banning certain AI-typical phrases and specific Unicode characters). These instructions are stylistic in nature and do not attempt to bypass core safety or ethical guidelines.

design-system-generalizer