The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to run multiple local Node.js and Python scripts for scaffolding and verifying components, such as python3 .claude/skills/_ux-ui-shared/scripts/scaffold_component.py and several node scripts for auditing and state verification.
[INDIRECT_PROMPT_INJECTION]: The instruction to run python3 .claude/skills/_ux-ui-shared/scripts/scaffold_component.py "<Name>" identifies a vulnerability surface where user-provided content (the component name) is interpolated into a shell command. The skill provides no guidance on sanitizing this input, creating a command injection risk.
Ingestion points: User-supplied component name in the <Name> placeholder.
Boundary markers: None present.
Capability inventory: Shell command execution via python3, node, and npx; browser automation via Playwright.
Sanitization: None described.
[DYNAMIC_EXECUTION]: The skill provides a JavaScript snippet for browser automation using Playwright/Chromium (chromium.launch). This snippet instructs the agent to load local files via the file:// protocol and write screenshots to /tmp/x.png, which facilitates the dynamic assembly and execution of scripts against the local filesystem.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx shadcn@latest add to fetch and install UI primitives from a well-known service.

design-component