The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/vendor.sh script downloads ESM modules from the official NPM registry (registry.npmjs.org). This practice, referred to as 'vendoring,' allows the skill to operate without relying on external CDNs, which is noted as a security and reliability preference in the documentation.
[COMMAND_EXECUTION]: The skill provides developer-oriented shell commands for common tasks, such as generating Tailwind CSS via npx tailwindcss, serving files via python3 -m http.server, and running local integration tests using Playwright. These commands are standard for the described development workflow.
[INDIRECT_PROMPT_INJECTION]: Code examples in SKILL.md and assets/component-patterns.md demonstrate how to parse and display data from external files (e.g., CSV). While this introduces an ingestion point for untrusted data, the skill correctly notes that Preact escapes output by default, providing a baseline defense against injection-based attacks.
[DYNAMIC_EXECUTION]: The skill includes a 'Container Testing' workflow that involves executing a Python script via a shell heredoc to perform integration testing with Playwright. This dynamic execution is scoped to the local development environment for validation purposes.

developing-preact