The Agent Skills Directory

[PROMPT_INJECTION]: The skill utilizes an autonomous loop pattern where instructions for the next iteration are read from a local file (.stitch/next-prompt.md). This creates a persistent surface for indirect prompt injection where a compromised project file could influence future agent actions.
Ingestion points: The agent parses the task content and page metadata from .stitch/next-prompt.md (Step 1).
Boundary markers: The skill uses YAML frontmatter to separate the page name from the prompt, but it lacks explicit boundary markers or instructions to disregard malicious instructions embedded within the markdown body of the baton.
Capability inventory: The skill possesses high-privilege capabilities including Bash access, file system Write permissions, and access to stitch generation tools.
Sanitization: No sanitization, validation, or filtering is performed on the content of the baton file before it is incorporated into the agent's context.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform file system operations (moving files to the public directory) and to start a local development server (npx serve) for visual verification.
[EXTERNAL_DOWNLOADS]: The skill downloads generated HTML and PNG assets from remote URLs (downloadUrl) provided as output by the Stitch MCP server tools. It also modifies these URLs by appending dimension parameters (e.g., =w{width}) before fetching content.

stitch-loop