The Agent Skills Directory

[PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by reading various untrusted workspace files and interpolating their content directly into sub-agent instructions.
Ingestion points: User input from $ARGUMENTS, as well as workspace files including CLAUDE.md, competitive-analysis.md, design specs, brand guidelines, user research, and existing prototypes.
Boundary markers: The skill lacks delimiters (e.g., XML tags or triple quotes) or explicit instructions to ignore embedded commands within these files before passing them to the Generator and Evaluator sub-agents.
Capability inventory: The agent has the capability to spawn sub-agents, write arbitrary files to the prototypes/ directory, and open those files in a web browser.
Sanitization: There is no logic provided to sanitize or validate the content of the ingested files, allowing malicious instructions hidden in design specs or research notes to potentially influence the agent's behavior.
[COMMAND_EXECUTION]: The skill instructs sub-agents to generate executable code (HTML, CSS, and JavaScript) and subsequently "Open the prototype in the browser when done." This workflow executes code that is derived from untrusted project files. If an attacker-controlled context file contains malicious script tags, they could be included in the generated prototype and executed in the local browser context when opened by the agent.

prototype