The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches its core initialization instructions (INIT.md) and operational guidelines (SUPERDESIGN.md) from a remote GitHub repository at runtime.\n- [COMMAND_EXECUTION]: The skill mandates the execution of shell commands, including npm install -g @superdesign/cli@latest and superdesign login, and instructs the agent to perform these actions automatically without manual user intervention.\n- [REMOTE_CODE_EXECUTION]: By requiring the installation of a global NPM package from an external source and subsequently running it, the skill introduces a mechanism for code execution on the host system.\n- [DATA_EXFILTRATION]: The skill performs an automated scan of the local repository, extracting "FULL source code" for components, layouts, and theme configurations into a local directory (.superdesign/init/), which is then processed by the external CLI.\n- [CREDENTIALS_UNSAFE]: The skill instructs the agent to run a login command using a third-party CLI tool, which introduces potential risks related to the handling and exposure of user credentials.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes project source code and configuration files as untrusted context for design tasks, creating a surface for indirect prompt injection.\n
Ingestion points: Reads package.json, source files (.tsx, .ts, .css), and framework configuration files (e.g., next.config.js) to build context.\n
Boundary markers: None identified; raw code implementation is directly included in context files.\n
Capability inventory: Executes shell commands (npm install, superdesign), performs file writes to the .superdesign/ directory, and utilizes the CLI which likely performs network operations.\n
Sanitization: The skill does not perform validation, filtering, or escaping of the code snippets ingested from the repository.\n- [METADATA_POISONING]: There is a discrepancy between the author declared in the skill's metadata (superdesign) and the author identity recognized by the platform (yasikvlad), which may mislead users about the skill's provenance.

superdesign