The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes standard command-line utilities including ls, grep, and sort to identify design token definition files and scan the codebase for hardcoded CSS properties and React inline styles.
[EXTERNAL_DOWNLOADS]: The instructions suggest installing stylelint and stylelint-declaration-strict-value via npm. These are widely recognized and reputable open-source tools used for maintaining code quality and consistency in CSS development.
[INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface for indirect prompt injection because it processes untrusted data from the local codebase. * Ingestion points: Scans project files with .css, .scss, .tsx, and .jsx extensions in the src/ directory (SKILL.md). * Boundary markers: None are explicitly defined in the instructions to separate code content from instructions. * Capability inventory: Read-only file system access via ls and grep, plus package installation capability via npm (SKILL.md). * Sanitization: File contents are matched against regular expressions and reported to the user without prior sanitization or escaping.

validating-design-tokens