The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external websites to extract design tokens and subsequently modifies the user's local codebase based on that content. An attacker could host a website with malicious instructions hidden in CSS or HTML to trick the AI into making unauthorized changes to the user's application.
Ingestion points: External HTML content is fetched via scripts/scrape_html.sh and saved to /tmp/target_page.html for analysis.
Boundary markers: The skill lacks explicit instructions or delimiters to distinguish between legitimate design data and potential embedded instructions in the scraped content.
Capability inventory: The skill has the capability to modify critical configuration files such as tailwind.config.js, globals.css, and various frontend components as described in SKILL.md (Step 5) and references/apply-guide.md.
Sanitization: There is no validation or sanitization of the scraped data before it is processed by the agent.
[COMMAND_EXECUTION]: The skill executes local bash scripts (scripts/scrape_html.sh and scripts/screenshot.sh) to interact with the Bright Data API. These scripts use the curl -k (or --insecure) flag, which disables SSL certificate validation, making the connection vulnerable to man-in-the-middle (MITM) attacks that could potentially compromise the user's API key or the data being transmitted.
[EXTERNAL_DOWNLOADS]: The skill fetches HTML and screenshot data from arbitrary third-party URLs provided by the user using the Bright Data Web Unlocker service at api.brightdata.com.

design-mirror