The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via user-supplied project descriptions.
Ingestion points: Untrusted data enters the agent context through the $ARGUMENTS variable in SKILL.md.
Boundary markers: The prompt does not utilize delimiters (e.g., XML tags, triple quotes) or specific "ignore embedded instructions" warnings to isolate user input.
Capability inventory: The skill has the ability to execute local scripts via Bash and delegate file-writing tasks to sub-agents via the Task tool.
Sanitization: There is no evidence of input validation, escaping, or filtering of the user-provided content before it influences the model generation logic.
[COMMAND_EXECUTION]: The skill executes a local script to generate visualizations of the recommended data models.
Evidence: The instruction node scripts/gen-diagram.mjs --file <schema> uses the Bash tool to run a local script. While the script itself is part of the skill distribution, it operates on data structures derived from user input.

design