The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The assets/vanilla-starter/index.html file loads fonts from Google's well-known font service (fonts.googleapis.com and fonts.gstatic.com). This is a standard and safe practice for web projects and does not pose a security risk.
[INDIRECT_PROMPT_INJECTION]: The AssistantRail component in assets/nextjs-app-router-starter/components/AssistantRail.tsx accepts user input through a prompt field. While this represents a data ingestion surface, it is judged to be safe. \n
Ingestion points: The prompt state in AssistantRail.tsx captures user text. \n
Boundary markers: No explicit boundary markers are present in the UI component logic. \n
Capability inventory: The skill and its components do not possess dangerous capabilities; no subprocess calls, exec/eval usage, file-writing, or network operations are present in any script. \n
Sanitization: The input is sanitized via .toLowerCase() for simple keyword matching to select pre-defined UI suggestions.
[SAFE]: The skill documents and implements industry-standard safety patterns, such as human-in-the-loop controls (Apply/Undo) and clear labeling for AI-generated content in the provided UI examples.

frontend-design