The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and processes the entire application codebase during the rebranding and sweep phases, which introduces a surface for indirect prompt injection attacks where malicious instructions could be embedded in the codebase being rebranded.
Ingestion points: The skill ingests data from replica/fixes.md, replica/brand.json, and all non-binary files within the target project directory during the execution of sweep.py and string replacement tasks.
Boundary markers: The instructions lack explicit delimiters or specific guardrail prompts to help the agent distinguish between application data and potential instructions embedded in the project files.
Capability inventory: The skill is capable of writing configuration and documentation files (replica/brand.md, replica/brand.json), updating design tokens, and performing string replacements across the codebase.
Sanitization: No sanitization, validation, or escaping mechanisms are described for the content extracted from the project files before it is processed by the agent.

replica-brand