The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection because it ingests and processes 'source HTML' and 'styledHtml' from potentially untrusted external web pages.
Ingestion points: The skill takes source HTML and styledHtml (computed-style-inlined snapshots) as primary inputs to guide the block rebuilding process.
Boundary markers: Absent. The instructions do not specify any delimiters or ignore-markers to prevent the agent from following instructions embedded within the HTML comments or text content of the source.
Capability inventory: The skill has the ability to list files in the theme directory (list <path>) and write new configuration files (written as a new styles/blocks/<slug>.json file).
Sanitization: Absent. There is no requirement for the agent to sanitize or validate the source HTML before parsing it for layout and content decisions.
[COMMAND_EXECUTION]: The skill instructs the agent to perform file system operations based on path parameters provided by the orchestrator.
Evidence: It specifically directs the agent to "list /wp-content/themes//styles/blocks/*.json" and create new files in that directory. While these are functional requirements for WordPress development, they rely on the integrity of the studioSitePath and themeSlug variables to prevent unauthorized file access or path traversal.

rebuild-section