The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides explicit instructions to install an external tool and execute a script from it. In references/ux-pass.md, it directs the installation of the uipro-cli package and subsequently instructs the agent to locate and execute a Python script (scripts/search.py) from the resulting installation folder.
[EXTERNAL_DOWNLOADS]: The references/ux-pass.md file contains instructions to download and initialize external software using npx uipro-cli init --ai claude. This targets a third-party source not recognized as a trusted vendor or service.
[COMMAND_EXECUTION]: The skill uses shell commands to perform core operations. In references/ux-pass.md, it specifies running python3 with a path constructed at runtime to execute an external script, alongside the npx command used for initialization.
[DYNAMIC_EXECUTION]: The skill employs dynamic execution by searching for a file path at runtime based on metadata (name: ui-ux-pro-max) and executing the found script. Furthermore, Phase 5 in SKILL.md describes a dynamic flow where a 'blind judge' subagent is spawned to evaluate content and return structured JSON output.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection.
Ingestion points: Untrusted data enters the context during Phase 0 (Intake) in SKILL.md, where user-provided business details, target reader profiles, and search intent are collected for processing.
Boundary markers: The instructions lack any delimiters or markers (e.g., XML tags or clear separators) to isolate untrusted input from the primary system instructions.
Capability inventory: The skill has shell execution capabilities (python3, npx) as defined in references/ux-pass.md and file-writing capabilities as implied in the 'CMS split' handoff in references/handoff-kit.md.
Sanitization: There is no evidence of input validation, escaping, or filtering of external content before it is interpolated into prompts or used in evaluation passes.

page-builder