The Agent Skills Directory

[SAFE]: The skill serves as a documentation resource for the @clack/prompts and picocolors libraries. No malicious logic or suspicious instructions were identified.
[EXTERNAL_DOWNLOADS]: The documentation includes standard installation instructions for @clack/prompts via the official NPM package registry.
[DATA_EXFILTRATION]: Documents the use of a password prompt for masked input, which is a standard security practice for CLI tools. It does not perform any unauthorized data collection or exfiltration.
[COMMAND_EXECUTION]: The examples demonstrate how to create interactive terminal flows and manage task spinners without executing arbitrary or malicious system commands.
[INDIRECT_PROMPT_INJECTION]: The skill documents how to ingest user input through various prompt components, which establishes a surface for indirect prompt injection if that input is later processed by an LLM without sanitization.
Ingestion points: User input is collected via text, multiline, and password components in SKILL.md and references/api.md.
Boundary markers: The examples do not demonstrate the use of delimiters or warnings to ignore instructions within the input.
Capability inventory: The skill documentation focuses on UI components and does not include examples of writing to files or performing network operations with the collected input.
Sanitization: No input sanitization or validation beyond basic length and presence checks is shown in the examples.

clack-prompts