The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface where user-supplied project and page names are used to construct file paths for the design system persistence feature. While the generated files are markdown-based and intended for documentation, the constructing logic in scripts/design_system.py lacks thorough path sanitization, creating a potential surface for directory traversal.
Ingestion points: User-provided query and project/page names in scripts/search.py.
Boundary markers: None; inputs are directly interpolated into file path strings.
Capability inventory: Filesystem write access in scripts/design_system.py to create the design-system/ directory structure and markdown files.
Sanitization: Basic replacement of spaces with dashes and lowercase conversion is performed, but navigation sequences such as ../ are not filtered.
[EXTERNAL_DOWNLOADS]: The SKILL.md file provides environment setup instructions that include commands to install Python using trusted system package managers such as brew, apt, and winget.
[COMMAND_EXECUTION]: The skill operates by running local Python scripts (scripts/search.py, scripts/design_system.py) to provide its features. These scripts process the included CSV data files and do not perform network requests or execute arbitrary commands based on untrusted input.

ui-ux-pro-max