The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands to install Python dependencies from a requirements file and to run the extraction scripts (design_system_extractor.py and extract_tokens.py) located in the tools directory.\n- [EXTERNAL_DOWNLOADS]: The Python scripts perform network requests to user-provided URLs to fetch HTML and CSS data. The main extractor script (design_system_extractor.py) explicitly disables SSL certificate verification (verify=False), which introduces a risk of man-in-the-middle (MITM) attacks during the data collection process.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it processes content from external, untrusted websites.\n
Ingestion points: External website content is fetched by the DesignSystemExtractor class in design_system_extractor.py.\n
Boundary markers: The skill uses a dedicated Python pre-processor to sanitize content before it is presented to the LLM, reducing the risk of the model directly interpreting malicious HTML/scripts.\n
Capability inventory: The agent can perform network requests and write files (design_pattern.html) based on the extracted data.\n
Sanitization: The sanitize_html method removes potentially dangerous tags such as <script>, <svg>, <iframe>, and base64-encoded data, focusing only on structural elements and CSS classes.

design-system-extractor