The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's instructions include a command to install a global Node.js package (npm install -g prompt-to-asset). This package originates from an unverified source and is specified without a version lock, presenting a supply chain risk where malicious code could be introduced into the environment.
[COMMAND_EXECUTION]: The skill facilitates shell command execution by directing the agent to use npm to install dependencies globally, which can have persistent effects on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted local data to influence its subsequent actions and outputs.
Ingestion points: The skill instructions in SKILL.md mandate that the agent read the project README and existing brand assets.
Boundary markers: The instructions lack delimiters or explicit warnings to the agent to disregard instructions that might be embedded within the project files being read.
Capability inventory: The agent has the ability to write files to various directories (assets/, public/, src/assets/), execute installation commands, and call external MCP server tools.
Sanitization: No sanitization, validation, or filtering of the content from the README or brand assets is implemented before that content is interpolated into prompts or tool calls.

visual-asset-generator