The Agent Skills Directory

[PROMPT_INJECTION]: The skill has an inherent attack surface for indirect prompt injection (Category 8) as it processes external, potentially untrusted design sources to generate code and agent instructions.
Ingestion points: SKILL.md (Figma URLs, written design specs, brand guides, reference screens).
Boundary markers: Absent; the skill does not instruct the agent to use delimiters or ignore embedded instructions when reading these sources.
Capability inventory: File system writes to create UI libraries, documentation, and generate/extend project-specific UI skills (SKILL.md:76, references/registration-templates.md).
Sanitization: Absent; content from design sources is directly interpolated into documentation and skill templates.
[DATA_EXPOSURE]: The skill accesses local project metadata such as AGENTS.md, CONTEXT-MAP.md, and workspace matrices to determine the project's technical stack and output directory. This access is necessary for its primary function and follows legitimate development workflows.
[COMMAND_EXECUTION]: The skill mentions dispatching "local lanes" for parallel extraction and surveying tasks. This appears to be an internal platform orchestration feature for multi-step processing rather than a vector for arbitrary shell command execution.

design-system