The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves reading untrusted project data to gather context, which creates a surface for indirect prompt injection attacks.
Ingestion points: The 'Explore project context' step in SKILL.md explicitly instructs the agent to read files, docs, and recent commits.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when processing this external data.
Capability inventory: The skill has the authority to write new design documents to the file system and commit them to the git repository (SKILL.md).
Sanitization: There is no evidence of sanitization, validation, or filtering of the ingested project data before it is used to influence the agent's brainstorming and design output.
[COMMAND_EXECUTION]: The skill executes shell scripts and a Node.js server to provide its 'Visual Companion' feature.
Evidence: The skill uses scripts/start-server.sh to launch scripts/server.cjs, which starts a local HTTP and WebSocket server on a random high port.
Risk: While the server defaults to binding to 127.0.0.1, the configuration allows binding to 0.0.0.0 via the --host flag. If misconfigured in a remote or shared environment, the session's HTML fragments and visual mockups could be accessible to other users on the network.

brainstorming