The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of a global NPM package ui-ux-pro-max-cli and downloads the nutlope/hallmark skill from a GitHub repository. These sources do not match established trusted vendor patterns.
[COMMAND_EXECUTION]: The skill automatically runs shell commands to verify environmental prerequisites (npm list, which) and invokes an external CLI tool for initialization (uipro init) and artifact generation (uipro generate).
[PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by processing untrusted user input and incorporating it into a 'design spec' that serves as a mandatory contract for other agents.
Ingestion points: User-provided project type, stack, and brand mood, as well as data from auxiliary skills like spec-driven-development and brainstorming referenced in sections 2 and 3.
Boundary markers: The skill does not define specific delimiters or instructions within the spec.md file to prevent a downstream agent from obeying malicious instructions embedded in the input requirements.
Capability inventory: The targeted frontend agent (omo visual-engineering category) has the capability to write and modify UI code based on these instructions.
Sanitization: No evidence of sanitization or validation is present for user-provided variables before they are used in shell command arguments or output to the generated specification.

designer-handoff