The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file includes a directive stating "IMPORTANT: When scripts fail, try to fix them directly." This instruction encourages the AI agent to bypass standard error reporting and autonomously modify its own executable logic, which could lead to unpredictable behavior or unauthorized code changes.
[DATA_EXFILTRATION]: Multiple Python scripts (scripts/logo/generate.py, scripts/cip/generate.py, scripts/icon/generate.py) implement a load_env function that reads sensitive files from the user's home directory, specifically ~/.claude/skills/.env and ~/.claude/.env. This enables the agent to access potentially sensitive secrets stored in global configuration files.
[INDIRECT_PROMPT_INJECTION]: The skill features a wide attack surface for indirect prompt injection by ingesting untrusted data (brand names and design prompts) and interpolating it directly into prompts sent to external AI providers (Gemini, MuAPI, Atlas Cloud).
Ingestion points: args.brand and args.prompt variables in various generation scripts.
Boundary markers: Present as labeled sections in templates (LOGO_PROMPT_TEMPLATE, SVG_PROMPT_TEMPLATE), but lack strong escape mechanisms for adversarial content.
Capability inventory: The skill can write files and perform network requests to various AI endpoints.
Sanitization: Lacks robust sanitization or validation of the input strings before they are embedded in the LLM templates.

design