The Agent Skills Directory

[PROMPT_INJECTION]: The file references/canvas-design-system.md contains a behavioral override pattern: User already said: "It isn't perfect enough. Must be pristine... Apply this standard before delivery." This employs a simulated user quote to manipulate the agent's output style and priority, which is a classic injection technique used to bypass standard operating procedures.
[REMOTE_CODE_EXECUTION]: The skill's primary workflow, as described in SKILL.md and implemented in scripts/shadcn_add.py, relies on executing npx shadcn@latest. This pattern downloads and executes code from the public npm registry at runtime without version pinning, creating a vector for executing untrusted or potentially malicious remote code if the package or registry is compromised.
[COMMAND_EXECUTION]: The script scripts/shadcn_add.py uses subprocess.run to execute the npx command. It accepts a list of components as CLI arguments and appends them directly to the command list. This represents a command execution capability that could be exploited via flag injection if the agent populates the component list from untrusted user prompts.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: scripts/shadcn_add.py (via the components positional argument) and scripts/tailwind_config_gen.py (via multiple theme-related flags).
Boundary markers: Absent. The scripts do not use delimiters or warnings when processing these inputs.
Capability inventory: subprocess.run (in scripts/shadcn_add.py) and file-writing via Path.write_text (in scripts/tailwind_config_gen.py).
Sanitization: Absent. The scripts perform basic logic but do not sanitize inputs against argument injection or malicious string payloads before execution or file writing.

ui-styling