The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a workflow (Path B) that ingests and processes external DESIGN.md documents through an LLM to derive design tokens and configure system themes. This creates an attack surface where a malicious document could contain instructions designed to override agent behavior or manipulate the configuration of the Stitch project.
Ingestion points: The upload_design_md tool accepts designMdBase64 content derived from local markdown files, which is subsequently parsed by the Stitch service.
Boundary markers: Absent. The instructions do not provide the agent with specific delimiters or guidance to ignore embedded instructions within the ingested prose.
Capability inventory: The skill uses mcp__stitch__* tools to create and update design systems, apply themes to screens, and read/write project metadata.
Sanitization: Absent. The skill explicitly states that "Stitch parses meaning, not a fixed key-value format," which increases the reliance on the model's interpretation of untrusted prose.
[COMMAND_EXECUTION]: The skill provides explicit shell and PowerShell commands for the agent to execute locally to prepare data for the MCP server. While these are standard utilities (e.g., base64), they demonstrate a pattern of shell interaction based on skill instructions.
Evidence: references/design-md.md contains commands for Linux/macOS (base64 -w 0 DESIGN.md) and Windows PowerShell ([Convert]::ToBase64String(...)) to encode files before transmission.

stitch-design-system