The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using gh and git to fork repositories, clone source code, and create pull requests. These high-privilege operations are part of the core functionality and are performed after user approval.
[EXTERNAL_DOWNLOADS]: Fetches directory configuration and project files from the official shadcn-ui/ui repository on GitHub and performs connectivity checks on user-provided registry endpoints using curl.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests and processes metadata (names, descriptions, and features) from external registry.json files which are subsequently used in the generation of GitHub PR bodies and social media drafts.
Ingestion points: Registry metadata is downloaded from external URLs via scripts/validate-registry.sh and parsed by the agent.
Boundary markers: None identified. External metadata fields are interpolated directly into Markdown templates for PRs and posts.
Capability inventory: The agent has access to gh (PR management/repository access), git (local and remote filesystem operations), and curl (network access).
Sanitization: There is no evidence of sanitization or content validation on the description fields retrieved from external sources before they are used in generated output.

launch-shadcn-registry