The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill uses a 'baton-passing' pattern where the agent reads instructions for its next task from a local file (.stitch/next-prompt.md), executes them, and then writes new instructions to the same file to trigger the next iteration. This creates a surface for indirect prompt injection if an attacker can modify the baton file.
Ingestion points: The .stitch/next-prompt.md file (referenced in SKILL.md and resources/baton-schema.md).
Boundary markers: Absent. While the file uses YAML frontmatter, there are no instructions to the agent to treat the content as untrusted or to ignore embedded commands.
Capability inventory: The skill uses Write for file modifications, Bash for command execution, and MCP tools (stitch*:*, chrome*:*) for code generation and browser automation.
Sanitization: The skill lacks sanitization or validation of the instructions read from the baton file.
[EXTERNAL_DOWNLOADS]: The skill downloads HTML code and image assets from remote URLs provided by the Stitch MCP tool.
Evidence: SKILL.md instructs the agent to download files from htmlCode.downloadUrl and screenshot.downloadUrl (which the skill identifies as Google CDN URLs).
[COMMAND_EXECUTION]: The skill uses shell commands to facilitate the development workflow.
Evidence: SKILL.md (Step 4.5) instructs the agent to start a local server using npx serve site/public via the Bash tool.

stitch-loop