The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses npx to execute tools from the @google/design.md package for specification verification, document linting, and compatibility exporting. These operations are restricted to validating the structure and format of the DESIGN.md file.
[EXTERNAL_DOWNLOADS]: Fetches the @google/design.md package from the public npm registry. This dependency originates from a well-known and established technology organization.
[PROMPT_INJECTION]: The skill processes untrusted content from public websites and local repositories to reconstruct design documentation, which constitutes an indirect prompt injection surface.
Ingestion points: External data enters through public URLs (inspecting DOM, computed styles, and stylesheets) and local repository files.
Boundary markers: The skill enforces a strict YAML schema for tokens and requires a 'three-proof gate' (Observation, Basis, and Consequence) for every claim. It also mandates that the document remain private until linting and export validation succeed.
Capability inventory: The skill can execute shell commands via npx and write to the workspace file system (DESIGN.md).
Sanitization: Extracted values are normalized into predefined schema fields, and any data that is uncertain or lacks a clear contract is omitted.

create-design-md