The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted design documents provided by users.
Ingestion points: The skill reads document content from a user-provided path to identify claims and verify them against the codebase (SKILL.md, Step 2).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the instructions to prevent the agent from obeying instructions found within the document being reviewed.
Capability inventory: The agent has access to Read, Grep, Glob, and Write tools to perform its analysis (SKILL.md, allowed-tools).
Sanitization: There is no explicit validation or sanitization logic defined for the file paths or content extracted from the untrusted document.
[DATA_EXFILTRATION]: While the skill does not contain network-based exfiltration patterns, it uses the Write tool to create a review.md file. A malicious document could potentially trick the agent into reading sensitive local files (e.g., configuration files outside the project) and writing their contents into the review report, leading to local data exposure.
[EXTERNAL_DOWNLOADS]: The skill references several well-known industry resources and engineering blogs in references/sources.md to establish the research provenance of its review rubric. These sources include engineering blogs from The Pragmatic Engineer and official documentation from Fuchsia.

design-review