The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends the installation of an external NPM package uipro-cli and various system-level packages (python3, brew, apt, winget) through its documentation and templates.
[COMMAND_EXECUTION]: The script scripts/design_system.py constructs filesystem paths for data persistence using user-provided project names without sufficient sanitization. The project_slug logic in persist_design_system allows for path traversal (e.g., using .. in a project name), which could enable the agent to create directories and write files in unintended locations outside the skill's data directory.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface. It ingests untrusted user input to search localized CSV data and then presents the results to the agent without explicit boundary markers or instructions to ignore embedded commands. This could lead to the agent following malicious instructions if the underlying data sources or user queries are manipulated.

ui-ux-pro-max