The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests content from multiple local files to inform its design decisions and specialist agent tasks. While it follows a human-in-the-loop approval process, the broad data ingestion surface allows for potentially malicious instructions embedded in documents to influence the agent's behavior.\n
Ingestion points: Processes repository files such as design/gdd/*.md, design/registry/entities.yaml, docs/consistency-failures.md, and various technical reference documents in .claude/docs/ or docs/engine-reference/.\n
Boundary markers: Lacks explicit delimiters or instructions to ignore embedded prompts within the files it reads to clearly separate data from instructions.\n
Capability inventory: Possesses Write and Edit permissions for the filesystem and uses the Task tool to delegate complex design logic to other agents, creating a multi-step attack chain if context is poisoned.\n
Sanitization: No specific sanitization, escaping, or validation is applied to the content retrieved from the repository files before usage in prompts.

design-system