The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context injection pattern !command`` in SKILL.md to execute npx shadcn@latest info --json when the skill is loaded. This is used to automatically populate the agent's context with the current project configuration, installed components, and directory paths.
[EXTERNAL_DOWNLOADS]: The skill facilitates the downloading of code and configuration from external registries and arbitrary URLs via the npx shadcn@latest add command. While the skill recommends using the CLI and warns against manual fetching, this functionality inherently involves fetching remote content from potentially untrusted third-party registries or user-provided URLs.
[COMMAND_EXECUTION]: The skill relies on executing shell commands via package runners (npx, pnpm dlx, bunx) to perform project initialization, component installation, and documentation fetching. These operations are restricted by the allowed-tools field in the skill's frontmatter to the shadcn@latest package.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes untrusted data from external component registries and the project's local components.json file.
Ingestion points: Data enters the context through npx shadcn@latest info, docs, and search commands, as well as by reading files added from registries.
Boundary markers: The skill does not explicitly instruct the agent to use delimiters or ignore instructions embedded in the external content it processes.
Capability inventory: The skill has the capability to execute shell commands (via allowed-tools) and write files to the local filesystem.
Sanitization: There is no evidence of sanitization or validation of the content retrieved from external registries before the agent processes or executes it.

shadcn