The Agent Skills Directory

[COMMAND_EXECUTION]: In workflows/text-to-design.md, the skill instructs the agent to use run_command with curl -o to download design assets. This tool is not listed in the allowed-tools section of SKILL.md, potentially encouraging the agent to bypass restricted toolsets or use unauthorized shell capabilities if available in the global context.
[EXTERNAL_DOWNLOADS]: The skill frequently references downloading content from remote URLs provided by the Stitch MCP server (e.g., screenshot.downloadUrl and htmlCode.downloadUrl). While these are part of the intended service, the use of curl via shell and read_url_content to fetch remote data introduces risks if the remote service returns malicious or attacker-controlled URLs.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) as it ingests and processes untrusted HTML data from external URLs.
Ingestion points: workflows/generate-design-md.md uses read_url_content to fetch HTML code from remote URLs for analysis.
Boundary markers: The instructions do not define any delimiters or system instructions to ignore embedded commands within the fetched HTML.
Capability inventory: The agent has Write access to the local file system (to create .stitch/DESIGN.md) and access to the StitchMCP tool for screen generation and modification.
Sanitization: There is no mention of sanitizing, escaping, or validating the remote HTML content before it is processed by the agent to synthesize design rules.

stitch-design