The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it reads and processes untrusted user source code (CSS, JSX, Vue files) across multiple scripts such as assets/detect-component-tree.js and assets/detect-tailwind.js. However, since it uses static regex parsing rather than dynamic execution and does not exfiltrate data, the risk is classified as low.
Ingestion points: Files like .jsx, .tsx, .vue, .svelte, .astro, and .css are read into the agent's context.
Boundary markers: None explicitly present in instructions to distinguish scanned content from agent instructions.
Capability inventory: The skill uses fs.readFileSync but lacks network writing or dynamic evaluation capabilities (eval, exec).
Sanitization: Content is processed via regex and string normalization to generate a JSON report.
[COMMAND_EXECUTION]: The script assets/detect-tailwind.js imports execSync from the child_process module. A thorough review of the code confirms that this function is not called anywhere in the skill's logic, and no shell commands are actually executed. The presence of the import appears to be a leftover or intended for future use, and it does not pose a current security threat.
[DATA_EXPOSURE]: The skill accesses local project files which is its intended primary purpose (frontend scanning). It correctly implements safety best practices by ignoring sensitive directories such as .git, node_modules, and environment configuration folders in assets/scan-directory-tree.js.

skill-frontend-design-scanner