The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external post files to generate graphics.
Ingestion points: The skill reads the most recent post file within the project directory (SKILL.md).
Boundary markers: No delimiters or instructions are provided to the agent to ignore or sanitize embedded instructions within the post content.
Capability inventory: The skill uses AskUserQuestion and saves self-contained HTML files to the local file system.
Sanitization: There is no evidence of escaping, filtering, or validation of the post content before it is distilled into the HTML output or image prompts.
[DYNAMIC_EXECUTION]: In Path A, the skill generates a self-contained HTML file with inline CSS based on distilled content from a user-provided post. This presents a Cross-Site Scripting (XSS) risk if the post content contains malicious HTML or JavaScript that is verbatim copied into the generated file, which the user is then instructed to open in their browser.
[PROMPT_INJECTION]: The skill instructions include directives such as "CRITICAL: Auto-start on load," "Do not summarise," and "Do not explain options." These instructions are designed to override the agent's default conversational behavior and safety summaries to force immediate execution of the skill's logic.

graphic-designer