The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a suite of Node.js utility scripts (e.g., audit-nextjs-motion.mjs, plan-motion-change.mjs) used to inspect local project files and plan UI modifications. These scripts are executed via the allowed Bash tool and operate strictly on the local filesystem to analyze codebase patterns.
[INDIRECT_PROMPT_INJECTION]: The skill's auditing scripts ingest and analyze project source code to provide recommendations to the agent. While this pattern introduces an attack surface for indirect prompt injection via malicious code comments, the risk is classified as low because the scripts use deterministic regex patterns and return structured JSON data rather than opaque natural language that could easily hijack the agent's core instructions.
Ingestion points: scripts/audit-nextjs-motion.mjs and scripts/inspect-motion-target.mjs read project files from the user's repository.
Boundary markers: No specific boundary markers are used in the data ingestion, but output is structured for specific logic consumption.
Capability inventory: The skill can read project files and write animation templates to the filesystem.
Sanitization: The scripts use regex for static analysis of code rather than executing the code they read.
[DYNAMIC_EXECUTION]: Several scripts in the package orchestrate their tasks by spawning other local Node.js scripts within the skill's own directory. This dynamic execution is used for modularity (e.g., the planner calling the auditor) and is restricted to the bundled skill content.

nextjs-framer-motion-animations