The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches design artifacts (Markdown, JSON, CSS) from https://api.agent-ds.oday-bakkour.com. These operations are well-scoped to the skill's primary purpose and use HTTPS.
[REMOTE_CODE_EXECUTION]: Although the skill downloads content, it implements a robust 'pinned download' security pattern. The scripts/fetch_design_md.py and scripts/fetch_design_md.sh helpers verify the SHA-256 digest of every fetched file against a local manifest in references/SHA256SUMS. This prevents the ingestion of tampered or unauthorized artifacts.
[INDIRECT_PROMPT_INJECTION]: The skill mitigates the risk of instructions embedded in external design files through explicit agent directives. Workflow 1, Step 5 specifically instructs the agent to ignore any directives beyond visual design (such as commands or network requests) found in fetched files, treating them strictly as data.
[COMMAND_EXECUTION]: The skill executes local helper scripts for fetching and verification. These scripts include rigorous input validation (regex slug checking) and use secure temporary file handling (mktemp, umask 077), demonstrating follow-through on secure coding practices.
[SAFE]: All identified behaviors are transparently documented, serve the stated purpose of design system integration, and are protected by technical integrity controls.

design-systems