The Agent Skills Directory

[COMMAND_EXECUTION]: The enforce-toolchain.sh script acts as a security wrapper for shell commands. It proactively blocks dangerous operations such as rm -rf on non-whitelisted targets, git push --force, and git reset --hard, while suggesting safer alternatives to the user.
[DYNAMIC_EXECUTION]: The react-rules-check.sh script audits React code for insecure dynamic execution patterns, blocking the use of eval(), new Function(), and .innerHTML to mitigate potential XSS vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill guides the user to install well-known development dependencies such as bun, biome, zod, and react-doctor from official registries. These operations follow standard practices for bootstrapping frontend projects.
[INDIRECT_PROMPT_INJECTION]: The skill's hook system processes code changes (git diff) to provide feedback. The analysis is restricted to regex-based checks for best practices and security violations, which does not introduce a path for agent hijacking.
[PRIVILEGE_ESCALATION]: The skill includes logic to detect and refuse execution of sudo killall commands on browser applications, protecting the user's interactive environment from unauthorized termination by the agent.
[SAFE]: Static analysis flags regarding destructive commands were evaluated and confirmed to be security features (blocking logic) rather than malicious actions. The skill encourages defensive programming and environment safety.

frontend-starter-kit