The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes instructional steering in SKILL.md and scripts/logo/generate.py, such as 'ALWAYS generate output logo images with white background'. While intended for consistency, these instructions are susceptible to override by malicious user input due to the lack of input boundaries.
[COMMAND_EXECUTION]: The skill documentation in references/social-photos-design.md and references/design-routing.md provides numerous command-line patterns for the agent to follow, including Chrome headless operations for screenshot capture and the use of development tools like npx shadcn.
[EXTERNAL_DOWNLOADS]: The skill requires several external Python and Node.js dependencies to function, including google-genai, pillow, playwright, and puppeteer. These are standard tools but involve fetching code from remote repositories during setup.
[REMOTE_CODE_EXECUTION]: The instruction in SKILL.md stating 'IMPORTANT: When scripts fail, try to fix them directly' directs the agent to perform dynamic code modification. This creates a surface where the agent could be manipulated into introducing and executing malicious code under the guise of 'fixing' a script error.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes untrusted user data.
Ingestion points: User-provided arguments for brand names, industry descriptions, and design prompts (e.g., in scripts/logo/generate.py and scripts/icon/generate.py).
Boundary markers: None. User input is directly interpolated into larger system-like prompts sent to the LLM without XML tags, delimiters, or 'ignore instructions' warnings.
Capability inventory: The agent can execute local Python scripts, perform file system writes for generated assets, and run shell commands for screenshot utilities.
Sanitization: There is no evidence of validation, escaping, or sanitization logic for user-provided strings before they are incorporated into model prompts.

design