The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow instructions in workflows/text-to-design.md suggest using a run_command tool to execute curl for downloading design assets. This tool is not declared in the skill's allowed-tools manifest, which only specifies StitchMCP, Read, and Write, potentially encouraging the agent to bypass security constraints if the environment provides a shell execution tool by default. \n- [EXTERNAL_DOWNLOADS]: The skill requires downloading external HTML and image assets from dynamic URLs provided by tool outputs. While functional for design tasks, instructions to download content from arbitrary URLs at runtime can be misused or exploited if the source service is compromised. \n- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes user-provided design intents without sanitization or boundary markers. \n
Ingestion points: User design requests and descriptions processed in SKILL.md and workflows/. \n
Boundary markers: Absent; there are no delimiters or explicit instructions to treat user-provided descriptions as untrusted content. \n
Capability inventory: The skill has access to file writing (Write), design generation (StitchMCP), and instructions to attempt shell execution (run_command). \n
Sanitization: No input validation or escaping is applied to user-provided text before it is used to enhance the design generation prompt.

stitch-design