The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill's core workflow depends on reading instructions from a 'baton' file (next-prompt.md) and project state files (SITE.md, DESIGN.md). Because these files are intended to be modified throughout the development loop, they serve as a vector for indirect instructions that could influence agent behavior.
Ingestion points: next-prompt.md, SITE.md, and DESIGN.md are read at the start of every iteration (specified in SKILL.md Workflow).
Boundary markers: The skill relies on YAML frontmatter and Markdown headers for structure, but lacks robust isolation (like XML tags or clear 'ignore embedded instructions' delimiters) to prevent the LLM from obeying instructions hidden within the design data.
Capability inventory: The agent has access to Write, Bash, and Stitch tools, which could be misused if the baton file is poisoned.
Sanitization: While the skill instructs the agent to redact secrets, it provides no technical mechanism to sanitize or validate the content of the baton file before it is processed as a prompt.
[COMMAND_EXECUTION]: Unverifiable Local Script Execution. The SKILL.md file defines a 'Decision feedback protocol' that requires the execution of python3 utilities/skill-builder/scripts/record_skill_feedback.py. This script is not provided within the skill bundle, creating a dependency on an external or environment-provided script whose behavior cannot be verified by this analysis.

stitch-loop