The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it automatically reads and processes content from untrusted files within the user's project (such as tailwind.config.*, CSS custom properties, and theme files) to identify design patterns. This extracted information is used to programmatically construct prompts for an LLM in Phase 3. An attacker could place malicious instructions inside these project files to hijack the generation process or influence subsequent agent actions.
Ingestion points: Phase 1 reads project files including Tailwind configurations and CSS stylesheets (SKILL.md).
Capability inventory: The skill has the ability to execute shell commands via uv run for image generation and background removal (SKILL.md).
Boundary markers: There are no explicit delimiters or protective instructions used when interpolating the extracted project data into the LLM prompts.
Sanitization: No sanitization or validation is performed on the content retrieved from the design files.
[COMMAND_EXECUTION]: The skill uses uv run to execute a local Python script (scripts/remove_bg.py) and a script from an external skill (nano-banana-pro). While these are core functionalities of the skill, they represent an execution surface that relies on parameters (such as prompts and filenames) which could be influenced by external data.
Evidence: Subprocess calls in SKILL.md Phase 3 and Phase 4.

web-art