The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use standard shell commands such as ls and find to enumerate project directories (e.g., docs/copy/, docs/content/) and locate voice or tone documentation. It also directs the agent to execute a local Node.js linter script against project source files.
[DYNAMIC_EXECUTION]: The skill includes a custom Node.js script (scripts/copy-lint.mjs) which is executed locally to extract and analyze UI strings from the project's codebase. The script uses built-in Node.js modules (node:fs, node:path) to read files and perform regex-based linting for style and grammar violations (e.g., em-dashes, exclamation marks, or banned phrases).
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by reading project source files (./src) to extract UI strings for auditing. While this represents a potential injection surface, the risk is mitigated by the skill's instructions for the agent to verify all findings against the original data or code and the script's use of deterministic regex matching rather than executing or interpolating the extracted content in a way that could lead to command injection.
[SAFE]: The skill references numerous trusted external resources for design standards and regulatory compliance, including official guidelines from Adobe, Microsoft, Apple, IBM, and the European Commission. All identified behaviors are consistent with its primary purpose as a developer productivity and copy auditing tool.

ux-copy