The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructs the agent to execute a Node.js script (resolve-context.mjs) located at a variable path (<installed-ss-resolve>). Executing code from paths determined at runtime or provided as placeholders can be exploited if the agent is misled into targeting a malicious file.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied design references and configuration values to generate a STYLESEED.md file. This file is then processed by a script whose output (effective-rules.md) is read back into the agent's context. This creates a loop where malicious instructions embedded in untrusted design data could potentially influence agent behavior.
Ingestion points: User-provided product descriptions, brand requirements, and external references in Step 1-7.
Boundary markers: The instructions do not specify any delimiters or safety warnings when the agent reads the generated effective-rules.md bundle.
Capability inventory: The skill has access to Bash, WebFetch, and Write tools.
Sanitization: There is no mention of sanitizing or validating the content of user-provided strings before they are written to the design lock file.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to run Node.js scripts and context resolution logic, which represents a high-privilege capability within the agent environment.

ss-setup