The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references several well-known technology documentation sites and repositories including Shadcn/ui (ui.shadcn.com), TanStack (tanstack.com), React Hook Form, and Zod. These are used strictly as reference material for standard design system implementations.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process application contracts, roles, and API data models. While this presents a potential ingestion surface for untrusted data, the skill mitigates risk by explicitly mandating security practices such as HTML output encoding (escapeHtml), CSRF protection, and strict schema validation using Zod.
[DYNAMIC_EXECUTION]: A code example in the Next.js implementation uses dangerouslySetInnerHTML to inject a small script for theme detection. The injected script is a static string literal used to prevent theme flicker and does not incorporate any external or untrusted input.
[DATA_EXPOSURE]: The skill mentions standard logging and monitoring tools like Sentry for error reporting and localStorage for persisting user preferences like sidebar state and theme. These are standard web development practices and do not involve unauthorized exfiltration of sensitive data.
[CREDENTIALS_SAFE]: The capability contract explicitly instructs the agent not to expose secrets or weaken authorization. No hardcoded credentials or unsafe secret management practices were detected in the instructions or examples.

webapp-gui-design