The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's workflow is heavily dependent on instructions ingested from an external source (a local file).
Ingestion Point: SKILL.md (Step 2) instructs the agent to check for an existing DESIGN.md in the project root and implement the UI based on its content.
Boundary Markers: There are no explicit delimiters or instructions to ignore potential natural language commands embedded within the DESIGN.md tokens or rules during the implementation phase (Step 6/7).
Capability Inventory: The skill has powerful capabilities, including Bash, Write, Edit, and Read (listed in allowed-tools in SKILL.md).
Sanitization: The skill does not sanitize the contents of the DESIGN.md file before processing it, meaning an attacker could include malicious instructions in the 'Principles' or 'Do's and Don'ts' sections of a design file.
[COMMAND_EXECUTION]: The skill executes local Python scripts using the Bash tool to manage the design catalog.
Evidence: SKILL.md defines several commands that invoke python "<skill-dir>/scripts/design_catalog.py".
Subprocess Usage: The maintenance script scripts/build_catalog.py uses subprocess.run to execute git commands. While this script is noted as not being part of the user workflow, it demonstrates the ability to invoke shell commands.

design-md