The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The references/vendor/shadcn/SKILL.md file employs dynamic context injection (the !command syntax) to execute npx shadcn@latest info --json at load time. This command is used to fetch project-specific configuration, framework details, and installed components to populate the agent's context. While shadcn is a well-known service, executing commands during skill loading represents a significant privilege that requires user awareness.
[COMMAND_EXECUTION]: The script runtime/validator_discovery.py uses subprocess.run to execute Python scripts as part of its internal validation discovery logic. This is used to find and run the shared_validate_design_system.py validator within the local environment.
[DYNAMIC_EXECUTION]: The skill includes logic in runtime/validator_discovery.py to dynamically resolve and execute a validation script. While the script path is validated to ensure it contains a specific role marker (DESIGN_SYSTEM_VALIDATOR_ROLE = 'implementation'), this pattern of discovering and executing code at runtime based on environment variables or file system paths is a notable capability.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection as it ingests and processes external design system templates and project configurations.
Ingestion points: Untrusted data enters the context via external design system manifests (design-system.yaml), project bindings (binding.yaml), and templates sourced from the catalog/ directory or project-local templates/ folders.
Boundary markers: The skill enforces a strict, linear 10-phase workflow (Phases 0-9). It uses a dedicated references/source-blind-boundary.md file to instruct the agent to ignore original source code or historical generation artifacts as references, maintaining a clean implementation boundary.
Capability inventory: The skill possesses capabilities for command execution (internal validation scripts and the shadcn CLI), as well as broad file system access for copying and adopting template files.
Sanitization: Ingested data is strictly validated against a suite of formal JSON schemas located in runtime/schemas/design-system/v1/. Integrity is enforced through SHA-256 canonical digests for all contract components and generated artifacts, ensuring the agent only acts on verified data.

ui-template-apply