The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context placeholders (!command) in SKILL.md to identify the project's directory structure, local icon registries, and the installed version of the lucide-react library. These commands are restricted to read-only environment discovery and do not involve user-supplied input.
[EXTERNAL_DOWNLOADS]: The skill retrieves icon files from well-known and reputable GitHub repositories, including lucide-icons/lucide, lobehub/lobe-icons, pheralb/svgl, and simple-icons/simple-icons. These are recognized as standard, safe sources for design assets.
[COMMAND_EXECUTION]: Shell commands such as find, node, python, and gh are used for project auditing and parsing SVG files. The parsing logic specifically uses regular expressions to extract SVG path data (d attribute), which effectively mitigates risks associated with processing potentially malicious XML content.
[INDIRECT_PROMPT_INJECTION]: While the skill ingests data from external repositories, it possesses a limited attack surface for prompt injection. The skill is designed to only extract specific path data rather than executing the downloaded files or treating their content as instructions.
Ingestion points: External SVG files fetched via gh api calls in references/sources.md.
Boundary markers: Not explicitly defined for the ingested SVG content.
Capability inventory: File system writes (components/icons/), network access via gh, and local script execution for parsing.
Sanitization: Uses regex matching (match(/ d="[^"]+"/g)) to isolate path data, preventing the interpretation of other SVG elements (like scripts or metadata) by the agent.

find-icon