The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it is designed to ingest and process untrusted external data, including client briefs (text, documents, and images), repository files, and Figma URLs as specified in SKILL.md, modes/brief.md, and modes/critique.md. The instructions lack explicit boundary markers or sanitization requirements to isolate this external content from agent instructions. The skill possesses significant capabilities, including the ability to write files, generate ZIP archives, calculate SHA-256 checksums, and delete files (defined in modes/finalize.md), which could be leveraged if malicious instructions were embedded in a design brief.\n- [COMMAND_EXECUTION]: The skill, specifically within the finalize mode in modes/finalize.md, performs sensitive file system operations such as directory creation, asset generation, and deletion of superseded paths for project cleanup. While these actions are necessary for the skill's functionality, they represent a privileged level of system access. The skill manages this risk by explicitly instructing the agent to inventory all target paths and secure user approval before proceeding with any file deletion.

design-director