The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided data to generate design recommendations and persist them to the filesystem, creating an attack surface for indirect prompt injection.
Ingestion points: User-provided strings for product types, industries, keywords, and project/page names are passed as arguments to the scripts/search.py helper script (as seen in the workflow instructions in SKILL.md).
Boundary markers: No boundary markers, delimiters, or sanitization instructions are present to prevent the agent from interpreting malicious content within user queries as instructions for tool parameters.
Capability inventory: The skill includes a Python script scripts/search.py that possesses file-writing capabilities, specifically using the Path.write_text method to save design systems to the design-system/ directory.
Sanitization: The --page argument in scripts/search.py is used to construct a file path without validation or sanitization. An attacker could potentially influence the agent to provide a malicious path (e.g., using ../ sequences), leading to a path traversal vulnerability that writes files to unintended locations on the filesystem.

ui-ux-pro-max