The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that explicitly direct the agent to override safety protocols and bypass user oversight. In SKILL.md and reference/MCP-SERVER.md, the agent is told: "Do NOT skip this step or ask the user to do it manually" regarding the configuration of the MCP server, which involves writing to sensitive system files.
[PERSISTENCE]: The skill directs the agent to modify IDE and application configuration files that persist across sessions, including .vscode/mcp.json, .cursor/mcp.json, and claude_desktop_config.json. These changes register a persistent tool that is automatically executed whenever the environment starts.
[REMOTE_CODE_EXECUTION]: The skill relies on the execution of remote code through the command npx -y igniteui-theming igniteui-theming-mcp. The use of the -y flag is a high-risk pattern that bypasses interactive user prompts to install and execute code from the NPM registry.
[COMMAND_EXECUTION]: The skill provides specific shell command strings for the agent to execute, such as npx commands that fetch and run third-party packages, potentially allowing arbitrary code to run in the user's environment.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection through its ingestion of external project data.
Ingestion points: The detect_platform tool (referenced in SKILL.md) reads the project's package.json file to identify dependencies.
Boundary markers: There are no instructions for the agent to use delimiters or ignore embedded instructions when reading these project files.
Capability inventory: The skill has the capability to write to the file system (configuration files) and execute shell commands via the configured MCP server.
Sanitization: There is no description of sanitization, validation, or filtering of the data read from project files before it is processed by the agent's logic.

igniteui-react-customize-theme