The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (LOW): The skill fetches instructions at runtime from a remote URL.
Evidence: Source URL https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md belongs to the vercel-labs organization, which is a Trusted External Source.
Risk: Per [TRUST-SCOPE-RULE], the severity is downgraded to LOW. The skill depends on the availability and integrity of this external resource to function.
[PROMPT_INJECTION] (LOW): The skill implements an indirect prompt injection surface by fetching behavioral rules from an external source.
Ingestion points: command.md fetched via WebFetch (specified in SKILL.md).
Boundary markers: Absent. The agent is instructed to blindly fetch and apply rules without explicit delimiters or instructions to ignore embedded malicious commands.
Capability inventory: The skill reads local files (UI code) and generates design audits. It lacks explicit network write or shell execution capabilities within the provided files.
Sanitization: Absent. The fetched content is treated as authoritative for both rules and output formatting.
[NO_CODE] (LOW): The skill contains no executable scripts (Python, JavaScript, or Shell) and relies entirely on LLM reasoning and the WebFetch tool.

web-design-guidelines