The Agent Skills Directory

[COMMAND_EXECUTION]: The helper scripts scripts/generate_component.sh and scripts/setup_design_system.sh use the eval command to process user input received via read. This creates a shell injection vulnerability where a maliciously crafted component name or configuration value (e.g., using semicolons or backticks) could execute arbitrary commands in the environment where the skill is running.
[DYNAMIC_EXECUTION]: The skill's primary purpose involves generating source code and test files from templates. While this is expected behavior for a scaffolding tool, the reliance on unsafe shell practices (eval) to handle user-supplied variables during the generation process increases the risk of exploitation by untrusted inputs.

frontend-designer