The Agent Skills Directory

[OBFUSCATION]: The file reference.md contains obfuscated URLs that utilize URL encoding and a double protocol prefix (http://https:%2F%2F) to hide the destination domain context7.com. Examples include http://https:%2F%2Fcontext7.com%2Fwebsites%2Fshadcn_io%2Fllms.txt/thumbnail.jpg.
[INDIRECT_PROMPT_INJECTION]: The obfuscated URLs in reference.md point to a file path containing llms.txt. In the context of AI agents, llms.txt is a standard naming convention for providing instructions to language models. Referencing such a file on an untrusted external domain creates a potential vector for indirect prompt injection if the agent attempts to fetch or interpret the content.
[EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to install various Node.js packages and fetch component definitions from remote URLs. While many are standard for shadcn/ui, the inclusion of the domain context7.com and the recommendation for the package tw-animate-css (instead of the official tailwindcss-animate) is suspicious behavior and warrants review.

shadcn-ui