The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes data from external, potentially untrusted sources to guide its behavior and evaluation.
Ingestion points: The skill reads from docs/agents/project.md for startup instructions, design.md for UI case lists, and docs/standards/design-tokens.md for design requirements. It also analyzes the live application's rendered content via the browser.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat content within these external documents as data rather than instructions, nor are there warnings to ignore embedded directives.
Capability inventory: The agent has the capability to execute shell commands to start the application, perform file system operations (grep, git diff), and control browser sessions via kimi-webbridge (navigating to routes and taking screenshots).
Sanitization: The instructions do not specify any validation, filtering, or escaping of the content retrieved from the design documents or the rendered UI before it is processed by the agent's logic.
[COMMAND_EXECUTION]: The skill facilitates the execution of local shell commands as part of its core functionality.
Evidence: In SKILL.md Step 1, the agent is instructed to "discover the command" required to start the application if it is not explicitly provided in the documentation, and then execute that command to verify the app loads. This involves running arbitrary project-specific startup scripts or commands discovered in the local environment.

inspect-ui