The Agent Skills Directory

[SAFE]: The skill serves a clear utility purpose for design validation. Analysis of the instructions and reference files revealed no malicious intent, hidden commands, or attempts at persistence.
[EXTERNAL_DOWNLOADS]: The skill uses web_fetch to retrieve HTML, CSS, and component source code from user-provided live URLs or GitHub repositories. This is a legitimate functional requirement for a code-based design auditor.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external websites and design files. Ingestion points: External code and design data are ingested via web_fetch and Figma MCP tools. Boundary markers: The instructions do not define delimiters to isolate the ingested data from the system prompt. Capability inventory: The agent can create markdown files and modify Figma designs (with user confirmation). Sanitization: There is no explicit sanitization of the fetched content mentioned in the instructions.

design-auditor