The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project data (such as PRODUCT.md, DESIGN.md, and source code) which could potentially contain malicious instructions aimed at overriding agent behavior.
Ingestion points: Project files are read using scripts/load_context.py and scripts/verify_prose.py to inform design decisions and validate UI copy.
Boundary markers: The skill explicitly implements a safety wrapper in scripts/_untrusted_doc.py that tags ingested content with <<<UNTRUSTED_PROJECT_DOC>>> and includes a clear directive for the agent to treat the content as data only.
Capability inventory: The skill has the capability to write design artifacts (briefs, wireframes, and decision logs) to the workspace and delegates execution tasks like building and testing to subagents.
Sanitization: The wrap_untrusted_doc function provides a programmed layer of protection by delimiting untrusted content before it enters the agent's context.
[COMMAND_EXECUTION]: The skill configuration in manifest.json defines tools that execute local Python scripts for project synchronization and copy verification. These scripts are restricted to the local project environment and are configured as read-only tools to minimize risk.

heyeddi-design