The Agent Skills Directory

[SAFE]: The skill serves as a documentation and workflow guide for UI customization. It does not perform suspicious network operations, credential harvesting, or unauthorized file access.
[EXTERNAL_DOWNLOADS]: The skill mentions official vendor packages @luxalgo/vela and @luxalgo/vela-ui. As these belong to the skill's author, they are considered standard internal dependencies and represent no elevated risk.
[INDIRECT_PROMPT_INJECTION]: While the skill processes external theme data (via JSON), it includes built-in safety mechanisms. It recommends the use of checkTheme for validation and provides a specific security warning against enabling allowCss: true for untrusted JSON input, effectively mitigating risk for the agent and the application.
Ingestion points: Processes ThemeInput objects and JSON configuration files (e.g., vela-ui.json).
Boundary markers: Relies on standard structured data (JSON/TypeScript) and the css template tag to distinguish styles from logic.
Capability inventory: Used exclusively for UI styling (CSS generation) and theme validation.
Sanitization: Uses checkTheme for schema and name validation; explicitly warns developers to verify CSS source trust before activation.

theming-vela-ui