The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes internal utility scripts (scripts/check.py) that use subprocess.run to execute validation tools. These tools (validate_skill.py, package.py, etc.) are part of the skill's own codebase or the associated development environment, intended for quality assurance and packaging.
[DATA_EXPOSURE]: The skill incorporates extensive guidance on maintaining data privacy. For instance, references/vite-config.md explicitly warns against using environment variable prefixes (like VITE_) for secrets, and references/badge-systems.md advises against adding badges for private repositories or secret-bearing endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill scans local frontend files and processes web content via browser tools. While this presents a potential surface for indirect injection (e.g., malicious instructions in HTML comments), the skill is designed to treat scanner results as 'evidence' rather than authoritative commands, and it uses read-only operations for discovery.
[SAFE]: No obfuscation, data exfiltration, or malicious remote code execution patterns were detected. The skill uses standard, well-known development tools like uv and interfaces with established services like shields.io and shadcn.

design