The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute bundled Node.js scripts (scripts/detect-token-drift.mjs and scripts/check-contrast.mjs) to provide deterministic evidence for documentation. These scripts are standalone, use only standard Node.js modules (node:fs, node:path, node:process), and have no network access or external dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill has a large ingestion surface, reading various repository files such as AGENTS.md, CLAUDE.md, DESIGN.md, and application source code. While it lacks explicit boundary markers or content sanitization to prevent processing malicious instructions embedded in these files, the risk is mitigated by the skill's limited capabilities, which are restricted to local file reading and structured documentation generation without network exfiltration vectors.
[SAFE]: Analysis of the skill body, references, and scripts revealed no malicious patterns. There are no instances of obfuscation, credential theft, persistence mechanisms, or unauthorized privilege escalation. The skill's behavior is consistent with its stated purpose of generating objective documentation.

frontend-docs