The Agent Skills Directory

[SAFE]: The skill synchronizes content from the well-known shadcn-ui/ui repository. This is a legitimate external resource used for its stated purpose of repository synchronization.
[COMMAND_EXECUTION]: The skill uses standard development utilities including git, gh, and node to manage repository state, fetch updates, and parse configuration. These operations are explicitly defined in the provided reference documentation and are scoped to the project's synchronization needs.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the upstream repository and user-supplied review payloads. (1) Ingestion points: ../shadcn diffs and deltas.json entries as described in SKILL.md and references/planning.md. (2) Boundary markers: The skill uses structured JSON and explicit policies to guide the agent. (3) Capability inventory: File writes to apps/www and spawnSync for browser interaction in scripts/build-dashboard.mjs. (4) Sanitization: The dashboard script includes an escapeHtml function to prevent script injection in the generated report.
[DYNAMIC_EXECUTION]: A helper script (scripts/build-dashboard.mjs) uses spawnSync to open a generated HTML report in the default system browser. The command execution is restricted to opening a locally generated file and respects environments like CI where GUI operations should be skipped.

sync-shadcn