The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository data, including local instructions, design rules, and manifests, which serves as a potential vector for indirect prompt injection.
Ingestion points: The main SKILL.md instructions direct the agent to read various local project files (manifests, lockfiles, existing catalogs, design rules) to determine how to recreate or adapt the component catalog.
Boundary markers: The skill defines authorization boundaries for operations based on catalog state, but it lacks explicit markers or instructions to disregard embedded commands within the ingested project files.
Capability inventory: The skill can write files to the repository, execute shell commands via package managers (npm install, npm exec), and run a local verification script (check-catalog.mjs) that invokes the TypeScript compiler.
Sanitization: Basic structure and path validation are performed by the check-catalog.mjs script on the inventory file, though it does not fully sanitize the content used during template instantiation.
[COMMAND_EXECUTION]: The skill requires the execution of shell commands for its core functionality.
Evidence: templates/README.md and references/adaptation.md instruct the agent to run npm install and use the shadcn CLI (npm exec -- shadcn add) to manage UI components.
Evidence: The verification script templates/scripts/check-catalog.mjs.template uses execFileSync to run the TypeScript compiler (tsc) for validating generated assets.
[EXTERNAL_DOWNLOADS]: The skill references and downloads configuration and assets from well-known technology services.
Evidence: Components are added via the shadcn CLI, which fetches source code from the official registry at ui.shadcn.com.
Evidence: Specimen components in the templates/src/examples/ directory reference images from avatar.vercel.sh and images.unsplash.com.

woostack-design-system