The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to path traversal because it interpolates unvalidated user input directly into file system operations.
Ingestion points: The $ARGUMENTS variable, which contains the user-provided brand name from the /design-drift:lock command, is used to build multiple file paths.
Boundary markers: The instructions lack delimiters or constraints to ensure the brand name remains within the skills/designs/ or skills/brands/ subdirectories.
Capability inventory: The skill performs file-read operations (searching for bundled .md files) and file-write operations (creating .design-cache/ and .design-lock in the project root).
Sanitization: There are no instructions for the agent to sanitize the input for path traversal sequences like ../ or to validate that the resolved path is within the expected directory tree.

lock