The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the iOS application's user interface, including screenshots and accessibility element trees, which could potentially contain malicious instructions designed to influence the agent's behavior.
Ingestion points: UI accessibility elements (GET /elements), screenshots (GET /screenshot), and user-provided screen descriptions (e.g., in DESIGN.md).
Boundary markers: The instructions do not specify any delimiters or safety warnings to ignore embedded instructions within the ingested UI data.
Capability inventory: The skill utilizes shell execution (Bash), file system access (Read, Glob, Grep), and network communication with a local daemon.
Sanitization: No explicit sanitization, validation, or filtering of the external UI content is mentioned.
[DYNAMIC_EXECUTION]: The skill's preamble uses eval to execute shell commands generated by the gstack-slug utility to recover project context. Additionally, the skill is instructed to follow GSTACK_INSTRUCTION blocks that may appear in the output of the gstack-skill-start tool, representing a form of dynamic instruction injection from tool output.
[COMMAND_EXECUTION]: The skill makes extensive use of local command-line tools provided by the vendor (e.g., gstack-skill-start, gstack-slug, gstack-decision-log, gstack-learnings-log, gstack-skill-end) to manage its lifecycle, telemetry, and project state.
[DATA_EXFILTRATION]: The skill collects and transmits telemetry, decision history, and operational metadata to the vendor's local management directory (~/.gstack/) and via dedicated logging utilities. It also transfers screenshots and UI hierarchy data from the connected iOS device to the local agent environment.

ios-design-review