The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches a live component registry in JSON format from https://beui.dev/r/registry.json using curl. This is the standard mechanism used to discover available components within the library's ecosystem.- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands via npx, pnpm, or bun to interface with the shadcn CLI. These commands are used to view and add components to the user's local project.- [REMOTE_CODE_EXECUTION]: The use of npx shadcn@latest add @beui/<slug> downloads external component code from the beUI registry and integrates it into the project files. This is a functional requirement for component libraries following the shadcn distribution model.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an external JSON registry to determine which components to install. Ingestion points: Registry metadata (names and slugs) is fetched from beui.dev. Boundary markers: None; the agent is instructed to map user intent directly to the slugs found in the JSON. Capability inventory: The skill has shell execution capabilities via npx and curl. Sanitization: No explicit validation or sanitization of the remote registry content is performed before the data is used in shell commands. This represents a vulnerability surface typical for registry-based discovery tools.

beui