The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection. In Phase 2 (Q0), the agent is instructed to read an existing HTML file from a path provided by the user. If the content of this file contains malicious instructions, it could attempt to manipulate the agent's behavior during the session.
Ingestion points: Phase 2, Q0 reads a user-specified HTML file path from the project environment.
Boundary markers: No specific boundary markers or instructions to ignore embedded commands are present when processing the external file content.
Capability inventory: The skill can perform directory creation, file writing (./prototype/), and Git command execution.
Sanitization: No sanitization or validation of the input file content is performed before processing.
[COMMAND_EXECUTION]: The skill uses standard Git commands (git add, git commit) to persist the generated prototypes. These commands are executed only after explicit confirmation from the user in Phase 4.
[SAFE]: The skill references Google Fonts via a public CDN (fonts.googleapis.com) to provide typography for the prototypes. This is a well-known service and the reference is documented neutrally.
[SAFE]: The skill reads project-specific configuration from .spring-config.json to customize the design session (language, app name, etc.). This is a legitimate use of project metadata.

springboot-prototype-ui