The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands via npx playwright screenshot <url> within SKILL.md and references/suedify-playbook.md. Because the <url> parameter is a user-supplied variable interpolated directly into the command string without sanitization requirements, it allows for shell command injection (e.g., appending ; command to a URL).
[PROMPT_INJECTION]: In the "Gate policy: advisory, not blocking" section of SKILL.md, the instructions explicitly direct the agent to "Never block, delay, skip, rewrite, or refuse the action the user asked for because a check failed or a gate said hold." This directive attempts to bypass internal safety and quality controls by prioritizing user instructions over the agent's own risk assessments.
[EXTERNAL_DOWNLOADS]: The references/ui-component-sources.md file recommends that the agent download and incorporate UI components from third-party domains and GitHub repositories (e.g., beui.dev, rareui.com, transitions.dev). While some sources are well-known, others have unclear reputations, posing a supply-chain risk if the external code is malicious.
[INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves ingesting data from external URLs for analysis and restyling.
Ingestion points: Untrusted content enters the agent's context through user-provided reference_url targets and local project files like PRODUCT.md and DESIGN.md.
Boundary markers: No explicit delimiters or instructions are provided to distinguish ingested data from system instructions.
Capability inventory: The skill utilizes subprocess execution (npx) and has the capability to write to the file system (e.g., creating DESIGN.md and QA reports).
Sanitization: There is no mention of sanitizing or filtering the content fetched from external URLs before it is processed by the agent, allowing embedded malicious instructions in web pages to influence agent behavior.

johnny-suede-design