The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes npx @google/design.md to perform schema checks, linting, and token exports. This operation fetches and executes code from the NPM registry. The package originates from a well-known organization, which aligns with standard development workflows for this domain.
[COMMAND_EXECUTION]: The skill uses Bash to invoke the @google/design.md CLI tool. These commands (spec, lint, diff, export) are integral to the skill's ability to validate the generated DESIGN.md file against the official specification.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local codebase by scanning stylesheets, templates, and component files for design literals like hex codes and font sizes. This creates a surface area where malicious content in comments or strings could potentially influence the agent's output during the derivation process.
Ingestion points: File reading via Grep and Read across all project UI files (CSS, SCSS, JS/TS, templates).
Boundary markers: The skill generates structured YAML and prose within a DESIGN.md file and provides a temporary HTML 'swatch sheet' for human review before finalizing changes.
Capability inventory: The skill possesses Write, Edit, and Bash permissions, allowing it to modify the repository and execute shell commands.
Sanitization: Validation is performed via the @google/design.md lint tool, which enforces a specific schema on the generated artifact, reducing the risk of arbitrary content injection into the final document.

designkit