The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/sync-brand-to-tokens.cjs utilizes child_process.execSync to run a Node.js script located at .claude/skills/design-system/scripts/generate-tokens.cjs. Executing local scripts via shell commands using hardcoded or relative paths can be a security concern if the filesystem structure is manipulated or if the target script is compromised.
[DATA_EXFILTRATION]: The skill contains logic that could lead to unauthorized file exposure. The routing mechanism described in SKILL.md instructs the agent to load files based on the first word of the $ARGUMENTS variable (pattern: references/{subcommand}.md) without explicit path sanitization, which could be exploited for path traversal. Furthermore, the scripts/inject-brand-context.cjs script accepts a file path as a command-line argument and reads its content using fs.readFileSync without performing path validation, potentially exposing sensitive files to the agent context.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external and untrusted data, which presents an attack surface for indirect prompt injection.
Ingestion points: scripts/validate-asset.cjs (marketing assets), scripts/extract-colors.cjs (images), and scripts/inject-brand-context.cjs (markdown guidelines).
Boundary markers: The instructions do not define clear delimiters or markers to separate untrusted content from the system prompt.
Capability inventory: The skill scripts have the capability to read files from the filesystem (fs.readFileSync) and execute shell commands (child_process.execSync via the sync utility).
Sanitization: There is no evidence of sanitization or filtering of external file content before it is processed or presented to the agent.

brand