The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the repository, creating a surface for indirect prompt injection where malicious instructions embedded in design documents could influence the agent's behavior or the outcome of its review.
Ingestion points: The agent is instructed to read and parse several local files, including AGENTS.md, CLAUDE.md, .claude/docs/technical-preferences.md, design/accessibility-requirements.md, design/ux/interaction-patterns.md, and referenced GDDs (SKILL.md Workflow step 1; references/claude-skill.md Phase 2).
Boundary markers: The skill does not provide clear delimiters or specific instructions for the agent to treat the contents of these files strictly as data, increasing the risk of the agent following embedded commands.
Capability inventory: The skill utilizes Read, Glob, and Grep tools to gather information from the environment. While the reference documentation claims a read-only protocol, the main SKILL.md workflow includes a step to "make the change directly" for implementation tasks, suggesting the agent may have file-write capabilities.
Sanitization: There is no evidence of sanitization, filtering, or validation performed on the ingested markdown or technical documentation before it is processed.

ux-review