The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes the uxproof package from the NPM registry using the command npx uxproof@0.3.1 init --no-skills. This is the primary mechanism for extracting design contracts. The version is explicitly pinned to prevent silent updates or unreviewed remote code changes, and a manual fallback is provided for environments without network access.
[COMMAND_EXECUTION]: Utilizes shell commands to invoke the initialization and extraction tools within the repository environment.
[EXTERNAL_DOWNLOADS]: Fetches the uxproof utility from the standard NPM registry at runtime.
[PROMPT_INJECTION]: The skill includes dedicated safety instructions in references/agentic-setup.md to mitigate indirect prompt injection. It instructs the agent to treat repository content solely as data, to ignore any embedded directives like "ignore previous instructions," and to report suspected injection attempts. It also permits local configuration overrides while strictly forbidding them from relaxing safety constraints.
[CREDENTIALS_UNSAFE]: Implements a "Secrets hygiene" rule in references/rules.md that explicitly forbids the inclusion of tokens, secrets, or environment file content in the generated contracts, reports, or logs.

om-ux-setup