The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill clones a repository from an untrusted source: https://github.com/Eng0AI/awwwards-landing-page-template.git. This external source does not belong to a well-known service or the skill author's established infrastructure.
[COMMAND_EXECUTION]: The skill performs several command-line operations that execute code or manage system packages:
npm install: Installs dependencies from the potentially untrusted cloned repository.
npm run build / npm run dev: Executes scripts defined in the external repository.
vercel build / netlify deploy: Performs build and deployment operations to external cloud providers.
[CREDENTIALS_UNSAFE]: The skill uses the $VERCEL_TOKEN environment variable within shell commands. While using environment variables is standard practice, the skill facilitates authentication to external services using these tokens, which could be exposed in environment logs depending on the execution platform.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the way it handles external data:
Ingestion points: Files are downloaded from the Eng0AI/awwwards-landing-page-template repository into the local working directory (SKILL.md).
Boundary markers: There are no markers or instructions to ignore potential malicious content within the downloaded repository files.
Capability inventory: The skill uses npm install (code execution), npm run build, vercel build, and netlify deploy (network/deployment operations).
Sanitization: No sanitization or validation of the downloaded files is performed before execution.

awwwards-landing-page