The Agent Skills Directory

[SAFE]: The skill's primary logic in scripts/core.py and scripts/design_system.py is implemented using standard Python libraries and operates strictly on local CSV data files. No network operations or remote data fetching are performed.
[SAFE]: The persistence mechanism in scripts/design_system.py includes a safe_slug function that uses a strict whitelist ([a-z0-9_-]) to sanitize user-provided project and page names. This effectively prevents path traversal vulnerabilities when the tool writes MASTER.md or page-specific override files to the project directory.
[SAFE]: No hardcoded credentials or secrets are present. The provided stack-specific guidelines (e.g., for Next.js and Laravel) correctly instruct users to store secrets in .env files and use specific prefixes for client-side variables, demonstrating a security-conscious design.
[SAFE]: External URLs contained within the skill's data files are restricted to official framework documentation (e.g., angular.dev, nextjs.org) and well-known, trusted CDN services like cdnjs.cloudflare.com for library references.
[SAFE]: The skill does not use any dynamic code execution functions like eval() or exec(), nor does it utilize the !command syntax for pre-execution shell calls in SKILL.md.

ui-ux-pro-max