The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The script scripts/inject-brand-context.cjs reads content from docs/brand-guidelines.md and interpolates it into a structured text block intended for system prompt injection. If an attacker modifies the markdown file to include malicious instructions, the agent may follow them.
Ingestion points: docs/brand-guidelines.md is read by scripts/inject-brand-context.cjs.
Boundary markers: The script wraps the content in headers like BRAND CONTEXT: and VISUAL IDENTITY:, but it lacks explicit 'ignore embedded instructions' warnings for the AI.
Capability inventory: The skill scripts have the capability to write files to the project directory (design-tokens.json, design-tokens.css) and execute commands via execFileSync.
Sanitization: No sanitization or validation is performed on the extracted text before it is placed in the prompt.
[COMMAND_EXECUTION]: The skill uses execFileSync in scripts/sync-brand-to-tokens.cjs to run a Node.js script. While it uses a list of arguments rather than a shell string, it represents a command execution capability. Additionally, the test script scripts/tests/test_sync_brand_to_tokens.py uses subprocess.run to execute Node.js commands during testing.
[DYNAMIC_EXECUTION]: In scripts/sync-brand-to-tokens.cjs, the script path for GENERATE_TOKENS_SCRIPT is dynamically computed at runtime using path.resolve to target a sibling skill (design-system). The script then executes this external file using execFileSync.

brand