The Agent Skills Directory

[SAFE]: The skill operates as a purely instructional set for UI design engineering. It defines high-quality patterns for component states (hover, press, loading) and microcopy without introducing malicious instructions or behaviors.
[SAFE]: All external references and dependencies identified (such as shadcn/ui, Meta's Astryx, DiceBear, and Sonner) are well-known, legitimate tools within the frontend development ecosystem. The skill correctly identifies them as trusted sources for design patterns and components.
[SAFE]: The analysis found no evidence of prompt injection, data exfiltration, or obfuscation. The skill actually provides proactive security advice, such as recommending the use of environment variables for private registry tokens and warning against running unreviewed third-party registry code.
[INDIRECT_PROMPT_INJECTION]: As a tool designed to process and fix existing codebases and user-described UI problems, the skill possesses an inherent attack surface for indirect prompt injection. However, this is a standard risk for AI-based coding assistants and is mitigated by the skill's specific focus on UI logic and design tokens rather than high-privilege system operations. The severity is assessed as low.

khe-components