The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches SVG assets and metadata from api.iconify.design and svgl.app. These are well-established, reputable services for icons and logos. The automated detection of remote code execution is a false positive, as the curl commands download static SVG files and do not pipe them to a shell or execution engine.
[COMMAND_EXECUTION]: Uses curl for querying icon APIs and downloading SVG files directly to the project directory. It also uses bunx to interact with the shadcn CLI for adding components via the svgl remote registry.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external search APIs (api.iconify.design and api.svgl.app). This represents a theoretical attack surface if those APIs were compromised to return malicious instructions in metadata fields.
Ingestion points: Data enters the agent's context through curl search queries in SKILL.md.
Boundary markers: The instructions lack explicit delimiters for interpreting API responses but provide specific examples of expected JSON structures.
Capability inventory: The agent has the capability to write files via curl and install components via bunx based on the API results.
Sanitization: No specific sanitization of external metadata is described before it is processed by the agent.

icons