The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation and attribution section recommend the use of an external tool via npx get-shit-done-cc --hermes. This involves downloading and executing third-party code from a repository (gsd-build/get-shit-done) that is not included in the trusted vendors list.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input during the 'Intake' phase (questions about feel, references, and core actions) and interpolates these strings directly into generated HTML files and READMEs.\n
Ingestion points: User responses in Step 1 (Feel, References, Core Action).\n
Boundary markers: Absent; user input is mixed directly with the mockup code.\n
Capability inventory: The skill uses write_file to create mockups and browser_vision to inspect the results, which could potentially be influenced by malicious instructions in the user input.\n
Sanitization: No sanitization or filtering is performed on user input before inclusion in files.\n- [COMMAND_EXECUTION]: The skill uses the terminal tool to execute commands like mkdir for directory management and suggests the use of system commands (open, xdg-open, start) to view the generated assets.

sketch