The Agent Skills Directory

[PROMPT_INJECTION]: The skill's metadata deceptively claims the author is "Anthropic", which contradicts the verified author identity "zocomputer". This metadata poisoning can lead to unauthorized trust in the provided scripts and automated actions.\n- [COMMAND_EXECUTION]: The initialization script installs the pnpm package manager globally via npm install -g, which modifies the user's global software environment.\n- [COMMAND_EXECUTION]: The skill extracts an opaque local archive (scripts/shadcn-components.tar.gz) during setup. Since the contents are not provided for analysis, this represents an unverified code execution surface within the skill structure.\n- [EXTERNAL_DOWNLOADS]: The scripts automate the installation of numerous external Node.js dependencies from the npm registry. While the listed packages are common industry tools, the automated retrieval of a large dependency tree increases the supply chain risk profile.

web-artifacts-builder