The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from research findings and external guides to generate work orders.
Ingestion points: research/*.json, <task_folder>/design-guides-read.json.
Boundary markers: No explicit prompt delimiters or "ignore embedded instructions" warnings are used when interpolating external content into the agent's context.
Capability inventory: Scoped shell execution via design-actions.sh, Agent dispatch to various roles (design-critic, internal-searcher), and file writing to the task folder.
Sanitization: The design-actions.sh script uses jq for robust JSON construction and implements a refuse_if_unsafe check (sourced from recipes.sh) that flags shell characters in generated commands.
[DYNAMIC_EXECUTION]: The skill can generate and store shell commands in work orders (--run entries) based on external recipes or research findings.
Evidence: The verify command in design-actions.sh allows adding commands to work orders using the --run flag.
Mitigation: The skill requires explicit human approval (--approve-runs) at the close stage before any machine-generated command can be executed in subsequent build stages. The script also performs validation of the command string to prevent common shell injection patterns.

design