The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the execution of local utility scripts, scripts/inspect-assets.py and scripts/validate-layers.js, to perform specialized tasks such as determining image transparency, sampling background colors, and validating the accessibility and performance of generated HTML code. These tools are invoked within the local development environment using standard shell commands.- [EXTERNAL_DOWNLOADS]: The skill relies on external JavaScript libraries to deliver its core functionality. These include various GSAP plugins (Core, ScrollTrigger, ScrollSmoother, Flip, MotionPathPlugin, SplitText, TextPlugin) and the Lenis smoothing library. These resources are retrieved from the well-known jsdelivr.net CDN, which is a widely recognized and trusted service in the web development ecosystem.- [INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves processing user-uploaded image assets through an inspection script to provide design recommendations. This ingestion of untrusted data represents a theoretical attack surface for indirect prompt injection.
Ingestion points: The scripts/inspect-assets.py script accepts paths to user-provided image files as input arguments for pixel and metadata analysis.
Boundary markers: While the skill advises the agent to verify project context, there are no explicit delimiters defined for segregating untrusted binary asset data from the agent's control logic.
Capability inventory: The skill possesses the ability to execute Python scripts using the Pillow library and Node.js scripts for file system reading and regex parsing.
Sanitization: The inspection script employs standard Pillow methods for image processing, which provides a layer of baseline sanitization against malformed binary inputs.- [METADATA_POISONING]: A discrepancy was observed between the author mentioned in the YAML frontmatter of SKILL.md (Abbas Mir) and the author context provided in the skill environment (alirezarezvani). While this constitutes misleading metadata, it does not appear to serve a malicious function or alter the skill's technical safety profile.

epic-design