The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's setup instructions require downloading an external MCP server from a public registry.
Evidence: The 'Setup' section directs users to install @efectoapp/mcp via npx for Claude Code, Cursor, and Windsurf.
[REMOTE_CODE_EXECUTION]: The provided installation commands execute code from a third-party package at runtime.
Evidence: The command npx -y @efectoapp/mcp is used to fetch and run the server, granting the package execution privileges in the user's environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from a remote design canvas that could be manipulated to include hidden instructions for the AI agent.
Ingestion points: The agent ingests data from the remote Efecto server using tools like get_document, get_selection, and get_node_tree (found in the 'Reading State' section of SKILL.md).
Boundary markers: There are no documented boundary markers or instructions to treat the returned JSX/markup as untrusted content.
Capability inventory: The skill possesses extensive capabilities, including 68 different tools for modifying web structures, searching images via the Lummi API, and exporting content as base64 images.
Sanitization: The instructions do not mention any sanitization or filtering of natural language content present in the text nodes or metadata of the ingested design document.

efecto-web-design