The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data which could contain malicious instructions meant to influence the agent's behavior.
Ingestion points: The skill reads content from user-provided URLs and screenshots as specified in the 'Workflow' section of SKILL.md.
Boundary markers: The instructions include a 'Separate reference semantics' step (Keep/Change/Do not copy) which acts as a logical boundary, but there is no explicit instruction to ignore embedded text-based commands within the visual or remote data.
Capability inventory: The skill is granted file_write capabilities to generate multiple markdown and HTML files.
Sanitization: There is no mention of sanitizing or escaping content extracted from external URLs or OCR-ed text before it is written to local files.
[DYNAMIC_EXECUTION]: The skill generates example.html files based on user-provided design references.
Evidence: The od metadata section and 'What this skill produces' section in SKILL.md specify the creation of an example.html file. If the agent interpolates instructions or scripts found in the reference material into this HTML, it could lead to the delivery of malicious payloads (e.g., Cross-Site Scripting) when the user opens the preview file.

reference-design-contract