The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-authored files (PRODUCT.md, DESIGN.md, and source code) which represent an attack surface for indirect prompt injection. However, the skill explicitly mitigates this in scripts/_untrusted_doc.py by wrapping such content in <<<UNTRUSTED_PROJECT_DOC>>> tags with a warning to the agent to treat the content as data only and ignore embedded instructions.
Ingestion points: Reading of project files via scripts/load_context.py and scripts/verify_prose.py.
Boundary markers: Present; the wrap_untrusted_doc function provides clear delimiters and safety instructions.
Capability inventory: Subprocess execution (via shell subagent), local file writing to the .heyeddi/ directory, and visual auditing tools. No network exfiltration capabilities were found.
Sanitization: Content is wrapped in delimiters before processing to maintain context separation.
[COMMAND_EXECUTION]: The skill uses localized Python scripts for context loading and prose verification. These scripts use standard library modules (pathlib, json, argparse) and perform safe filesystem operations restricted to the project root. No arbitrary command injection vulnerabilities or dangerous shell executions were identified.

heyeddi-design