The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Node.js scripts (scripts/screenshot.mjs and scripts/token-lint.mjs) to automate UI testing and validate code against design tokens. These scripts are executed via the shell to perform core skill functions.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the playwright library and the Chromium browser. These are well-known, industry-standard tools used for browser automation and UI screenshot capture as part of the intended workflow.
[INDIRECT_PROMPT_INJECTION]: The skill's operational logic and 'taste' are determined by reading markdown and JSON files from the repository's design/ directory. If these files are modified by a malicious actor, they could inject instructions that override the agent's behavior during code generation or critique.
Ingestion points: The agent reads design/POV.md, design/UI_RULES.md, design/tokens.json, design/PATTERNS.md, design/DECISIONS.md, and design/BACKLOG.md at the beginning of every session.
Boundary markers: The skill lacks explicit boundary markers or instructions to treat the natural language content within these state files as data rather than instructions.
Capability inventory: The agent has permissions to modify project source code, execute local Node.js scripts, and perform network requests/browser automation via Playwright.
Sanitization: There is no evidence of content validation or sanitization applied to the instructions found within the state files before they are integrated into the agent's task context.

design-loop