The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow documentation in 'workflows/text-to-design.md' explicitly instructs the agent to use shell commands like 'curl -o' via a command execution tool (e.g., 'run_command') to download design assets to the local filesystem. This encourages the use of potentially sensitive shell access to manage remote files.
[EXTERNAL_DOWNLOADS]: The skill is designed to fetch remote HTML and screenshot assets from URLs generated by the Stitch MCP service. These files are stored in the '.stitch/designs' directory. Downloading and storing external content is a core feature but presents a surface for hosting or retrieving malicious payloads if the remote source is compromised.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) by ingesting untrusted data from external sources and using it to influence its internal state and future outputs.
Ingestion points: The 'workflows/generate-design-md.md' file instructs the agent to fetch and read HTML content from remote URLs using 'read_url_content'. Additionally, the 'SKILL.md' file requires reading the local '.stitch/DESIGN.md' file to gather context for prompt enhancement.
Boundary markers: There are no instructions provided to the agent to ignore or delimit embedded natural language instructions within the processed HTML or design system documents.
Capability inventory: The agent has the capability to write to the filesystem ('Write'), interact with the 'StitchMCP' for design generation, and is encouraged to use shell tools ('run_command') for networking.
Sanitization: No sanitization, validation, or escaping of the ingested HTML or markdown content is performed before it is used in the prompt enhancement pipeline.

stitch-design