The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a Python utility script scripts/_skill_cli.py which contains a run_command function utilizing subprocess.run. The implementation follows secure patterns by passing arguments as a list and avoiding shell execution, which prevents command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill documentation describes the use of several Model Context Protocol (MCP) servers via npx -y. While these facilitate the integration of well-known libraries like Quasar, PrimeVue, and Playwright, it also references a third-party scoped package @zcubekr/penpot-mcp-server. The skill includes clear instructions to obtain user approval before these tools are configured or installed, mitigating the risk of unauthorized external dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill defines a visual self-correction workflow where an agent takes screenshots of a local Vite development server using Playwright MCP and analyzes the visual output for defects. This process creates an attack surface where maliciously crafted content on the local server could attempt to influence agent behavior through the visual interpretation layer, although the impact is limited by the agent's existing safety guardrails.

vue-design-system