The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input as a search query for its BM25-based engine.
Ingestion points: scripts/search.py accepts a free-text user query which is used to score local CSV data in the data/ directory.
Boundary markers: Output is formatted as Markdown or ASCII tables without explicit delimiters between user-provided query context and generated content.
Capability inventory: The skill has the capability to create directories and write files locally via the persist_design_system function in scripts/design_system.py when the --persist flag is used.
Sanitization: Input queries are tokenized and scored but not sanitized; however, they are never executed or used in sensitive system operations.
[EXTERNAL_DOWNLOADS]: The data files contain numerous references to official documentation URLs (e.g., angular.dev, nextjs.org) and CDN links for font/library discovery (e.g., fonts.googleapis.com, cdnjs.cloudflare.com). These are used for documentation purposes and baseline configuration templates, not for automated runtime execution or unverifiable dependency loading.
[COMMAND_EXECUTION]: The skill provides a Python search engine that executes entirely on the local machine. It uses standard library modules (csv, json, pathlib) and does not use subprocess, os.system, or similar dangerous execution wrappers.
[DATA_EXPOSURE]: No hardcoded credentials or sensitive system path accesses were detected. The persistence feature writes design system documentation to a user-specified or current working directory.

ui-ux-pro-max