The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (HTML and CSS code) from Stitch projects to extract design tokens. A malicious actor could embed instructions within the project's source code (e.g., in HTML comments or text content) to influence the agent's output or behavior.
Ingestion points: The agent retrieves project screens and HTML source code via the stitch MCP server and web_fetch (documented in SKILL.md under 'Retrieval and Networking').
Boundary markers: The instructions do not define delimiters or provide warnings to the agent to ignore embedded instructions within the fetched assets.
Capability inventory: The skill has permissions to write files (Write) and perform network operations (web_fetch), which could be misused if an indirect injection is successful.
Sanitization: There are no documented steps to sanitize or filter the incoming HTML/CSS content before it is parsed and synthesized.
[EXTERNAL_DOWNLOADS]: The skill dynamically downloads content from remote URLs provided by the project metadata.
Evidence: SKILL.md specifies using web_fetch or read_url_content to download HTML from htmlCode.downloadUrl. While these are expected to be project assets, they originate from external endpoints.

design-md