The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes 'Host steps' (questions and choices) from external sources or other agent interactions to build prototypes. This untrusted data is interpolated into steps.js and individual prototype HTML pages, creating a vulnerability surface if inputs contain malicious instructions or scripts.
Ingestion points: SKILL.md (Procedure steps 2, 3, 4) specifies that host questions, Wayfinder tickets, and plain choices are used as primary inputs.
Boundary markers: The skill uses a structured JavaScript manifest (window.STEPS.push(...)) to delimit entries, but does not provide explicit instructions for sanitizing or escaping the content of host questions before interpolation.
Capability inventory: The skill possesses the ability to write files to the user's home directory (~/.prototyping), execute shell scripts (scripts/serve.sh), and run a background Python HTTP server.
Sanitization: The provided shell (assets/index.html) utilizes textContent for rendering UI elements, which mitigates XSS risks in the shell's own interface.
[DYNAMIC_EXECUTION]: The prototype shell (assets/index.html) implements a polling mechanism that dynamically loads and executes the steps.js manifest file as a script at regular intervals. Because the AI agent generates the content of this manifest based on potentially untrusted external inputs, this pattern represents a vector for executing injected content within the browser context of the prototype session.
[COMMAND_EXECUTION]: The skill includes and executes a local shell script (scripts/serve.sh) to manage the lifecycle of a Python-based HTTP server. The script is configured to bind strictly to the loopback interface (127.0.0.1), preventing external access to the served prototypes.

prototyping