The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's component documentation (found in components/*.md) is generated by fetching metadata from an external repository on GitHub (github.com/unovue/reka-ui). This creates a vulnerability surface where a compromise of the remote repository could result in malicious instructions being embedded in the skill's reference files.
Ingestion points: The scripts/generate-components.ts script fetches content from raw.githubusercontent.com/unovue/reka-ui/main/docs/content/meta/.
Boundary markers: Absent. The resulting documentation files contain raw component properties and descriptions without clear delimiters to prevent the agent from following instructions potentially embedded in that data.
Capability inventory: The skill primarily provides context for Vue component development. The generation script itself possesses fetch and fs.writeFileSync capabilities.
Sanitization: The script uses JSON.parse on data extracted via regex but does not specifically filter or sanitize the content for AI instructions before writing to the local filesystem.
[EXTERNAL_DOWNLOADS]: The maintenance script scripts/generate-components.ts downloads component definitions from GitHub. This targets a well-known service and the official source for the library described by the skill.
[DYNAMIC_EXECUTION]: The skill includes a TypeScript utility (scripts/generate-components.ts) designed to be executed via tsx. This script performs network operations to download external content and modifies the local file structure of the skill by writing documentation files.

reka-ui