The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill directs the agent to fetch and run external packages from the NPM registry. Specifically, it mentions the slop-detector package in SKILL.md and the @google/design.md package in references/design-md-authoring.md. The use of npx without pinned versions allows for the execution of arbitrary code updates from the public registry.
[REMOTE_CODE_EXECUTION]: The skill leverages the npx utility to execute remote code as part of its standard workflow.
An optional step in the critique mode calls npx slop-detector to analyze UI patterns.
The design validation workflow requires running npx @google/design.md lint DESIGN.md. While the latter is associated with a well-known organization, the execution mechanism itself remains a vector for remote code.
[COMMAND_EXECUTION]: The skill explicitly grants and uses the Bash tool to perform design linting and UI analysis, providing the agent with a powerful environment that could be abused if compromised.
[PROMPT_INJECTION]: The critique and authoring modes create a surface for indirect prompt injection by ingesting and processing potentially untrusted UI code files.
Ingestion points: The agent is instructed to read, grep, and glob built UI components and external configuration files (e.g., DESIGN.md).
Boundary markers: The skill lacks explicit instructions or delimiters to prevent the agent from following instructions embedded within the code it is reviewing.
Capability inventory: The agent has access to Bash and LSP tools, which increases the potential impact of an indirect injection attack.
Sanitization: There is no mention of sanitizing or filtering the source code files before they are read into the agent's context.

frontend