The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to ingest and parse untrusted HTML data provided either via user paste or through a remote fetch from a dynamic URL. This creates a surface for indirect prompt injection where malicious instructions could be embedded within the HTML source (e.g., in text content or hidden comments) to influence the agent's behavior during the conversion process.
Ingestion points: The skill retrieves HTML from a downloadUrl using web_fetch or accepts user-pasted HTML (SKILL.md).
Boundary markers: There are no specific instructions or delimiters mentioned to isolate the external content or warn the agent to ignore embedded commands.
Capability inventory: The skill has access to Bash, Write, and mcp_pencil tools, including the ability to generate and execute design batches (batch_design).
Sanitization: The skill focuses on parsing the DOM and Tailwind classes but lacks mechanisms to sanitize the input for potential instructional injections.
[COMMAND_EXECUTION]: The instructions specify using the Bash tool to perform network requests (fetching HTML) and file system operations (saving to temp/source.html). While used for data retrieval, the availability of a general shell tool with network access increases the potential impact of an exploit.
[EXTERNAL_DOWNLOADS]: The skill fetches HTML assets from external URLs generated by the Stitch service. As the skill identifies Stitch as a service associated with Google, these downloads are directed at supporting the core design conversion workflow.

pencil-design-from-stitch-html