The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from untrusted sources and uses it to construct instructions for sub-agents without sufficient isolation.
Ingestion points: The skill reads creative-brief.md and improvement notes from the plugins/[PluginName]/.ideas/ directory during Phase 1 (load-context).
Boundary markers: No specific boundary markers, delimiters, or "ignore instructions" warnings are defined for the content interpolated into the prompts for sub-agents in the delegation-protocols.md or SKILL.md documentation.
Capability inventory: The orchestrator invokes sub-agents (ui-design-agent, ui-finalization-agent) using the Task tool. These sub-agents are documented to possess significant capabilities, including the ability to write files (Write) and execute shell commands (Bash).
Sanitization: The workflow does not specify any validation, filtering, or sanitization of the content extracted from the creative brief before it is passed to sub-agents in the task prompt.

ui-mockup