The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted Vue source files for analysis.
Ingestion points: scripts/find_duplicate_ui.py reads the content of all .vue files in the project root.
Boundary markers: None present.
Capability inventory: The tool manifest defines the tool as readonly. The scanning script contains no network, file-write, or code-execution logic.
Sanitization: The script tokenizes template content using a restrictive alphanumeric regular expression, which effectively sanitizes input before it is used for similarity scoring or emitted to the agent.
[COMMAND_EXECUTION]: The helper script scripts/_skill_cli.py contains a wrapper for subprocess.run that was flagged by static analysis.
Evidence: The run_command function is designed for safe execution with shell=False and absolute path resolution for executables.
Risk Assessment: This functionality is currently unused by the find_duplicate_ui tool and is part of a standard library provided by the author.

no-duplicate-ui