The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the $ARGUMENTS variable directly within shell command templates in Phase 1 (find) and Phase 3.1 (grep). While the instructions tell the agent to parse the input as a comma-separated list, there is no explicit requirement to sanitize the resulting strings. If the agent fails to sanitize these inputs before interpolation, a user could provide a malicious component name containing shell metacharacters (e.g., ;, &, or `) to execute arbitrary commands.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by ingesting data from an external MCP server and user input without sufficient safeguards.
Ingestion points: The skill ingests user-provided component names via $ARGUMENTS and retrieves reference HTML, CSS, and accessibility guides from the fundamental-styles MCP server tools (get_component_html, get_accessibility_guide, get_css_classes).
Boundary markers: Absent. The skill does not instruct the agent to use delimiters or ignore potentially malicious instructions embedded in the data retrieved from the MCP server.
Capability inventory: The skill has significant capabilities, including shell command execution (find, grep, nx run, yarn format) and the ability to modify library files (.component.ts, .component.html, .spec.ts, and i18n translation files) in Phase 4.
Sanitization: Absent. There are no instructions to validate, filter, or escape the content retrieved from the external MCP server before it is used to modify the project's source code.

adopt-styles