The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to ingest and analyze untrusted external data, including PRDs, user-provided codebases, and screenshots as part of its primary workflow (Steps 1 and 2). This creates a potential attack surface where malicious instructions could be embedded in the processed materials, potentially influencing the agent's subsequent design or code generation tasks. The skill does include multiple human-in-the-loop checkpoints which help mitigate this risk.\n- [COMMAND_EXECUTION]: The skill directs the agent to execute shell commands for development and asset sourcing workflows. This includes running npm scripts found in the project's package.json for browser-based testing and utilizing CLI tools like yt-dlp and ffmpeg to extract high-fidelity assets from video frames, as specified in the Asset Protocol section of the main SKILL.md file.\n- [EXTERNAL_DOWNLOADS]: The skill references and downloads design assets, fonts, and JavaScript libraries from well-known services to build its artifacts. It uses Google Fonts for typography and utilizes jsDelivr and Unpkg to load common libraries such as Chart.js, D3.js, and Popmotion for the construction of interactive prototypes and dashboards.\n- [DYNAMIC_EXECUTION]: To facilitate React prototyping, the skill implements a workflow that loads the Babel standalone compiler from a CDN (jsDelivr) to transpile JSX code directly within the browser environment. This allows for the dynamic assembly and execution of agent-generated React components during the visual preview and testing process.

web-design-engineer