The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to run npx dwic-audit, which fetches and executes a package from the npm registry at runtime. This allows for the execution of unverified third-party code.
[EXTERNAL_DOWNLOADS]: The installation process requires adding an external marketplace and installing a plugin from the imsaif/design-with-claude repository. This introduces external code dependencies into the agent's core plugin environment.
[DATA_EXFILTRATION]: The dwic-audit tool is documented to send an anonymous run counter and category-level counts to a remote server. While it provides a flag to disable this, the default behavior is to transmit usage metadata. Additionally, the optional MCP server requires an authentication token from an external domain (designwithclaude.com).
[COMMAND_EXECUTION]: The skill includes a shell script in its 'Decision tree' logic to verify the plugin's presence in the local file system, which the agent is expected to execute to determine its current state.
Evidence: f=~/.claude/plugins/cache/design-with-claude/design-with-claude; [ -e "$f" ] && ! grep -qs "^das:" "$f" && echo "installed" || echo "pointer"
[INDIRECT_PROMPT_INJECTION]: The skill audits arbitrary project files (CSS, HTML, tokens) and feeds these results to specialist slash commands. This creates a surface where malicious instructions embedded in a project's source code could be interpreted by the LLM as authoritative design instructions during the 'Fix' phase.
Ingestion points: Project files, design tokens, and local markup are parsed by npx dwic-audit (SKILL.md).
Boundary markers: None identified in the provided files to separate audited data from the specialist instructions.
Capability inventory: The skill relies on the agent's ability to read files and execute shell commands to perform audits and apply design fixes.
Sanitization: No sanitization process is described for the content extracted from project files before it is processed by the design specialists.

design-with-claude