The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes design token files and weaves metadata, such as '$description' or extension fields, directly into natural language prompts used for image generation and documentation.
Ingestion points: Loads user-supplied .tokens.json files via scripts/dtokens/model.py and scripts/dtokens/resolve.py.
Boundary markers: Absent. The skill does not wrap interpolated metadata in delimiters or provide instructions to ignore potential commands within the data in scripts/dtokens/generate.py or scripts/dtokens/export_prompt.py.
Capability inventory: The skill can invoke other AI agent scripts via subprocess.run and perform network requests for transcription.
Sanitization: Absent. No filtering or sanitization is performed on token metadata before it is interpolated into prompts for other skills.
[COMMAND_EXECUTION]: The skill executes external scripts to perform image generation as part of its prompt-to-asset workflow.
Evidence: scripts/dtokens/generate.py uses subprocess.run to execute Python scripts located in the local environment, such as ~/.claude/skills/gpt-image-2/scripts/gpt_image_2.py and ~/.claude/skills/nano-banana/scripts/nano_banana.py.
Context: This execution is part of the skill's primary purpose to generate brand-compliant assets.
[EXTERNAL_DOWNLOADS]: Fetches resources from well-known services to support previews and transcription.
Evidence: Fetches font stylesheets and assets from fonts.googleapis.com and fonts.gstatic.com for HTML previews in scripts/dtokens/export_preview_html.py.
Evidence: Proxies audio data to api.groq.com for transcription services in scripts/dtokens/annotate.py.

design-tokens