The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external web pages via browser tools.
Ingestion points: The agent utilizes browser_navigate and browser_vision to load and inspect rendered web pages as part of the verification process (e.g., in references/browser-verification.md).
Boundary markers: The instructions do not define explicit boundary markers or instructions to ignore potential commands embedded in the visual or textual content of the processed pages.
Capability inventory: The skill environment provides the agent with interaction capabilities such as browser_click, browser_type, and browser_console execution.
Sanitization: No explicit sanitization or filtering of external content is performed before the agent analyzes and acts upon it.
[COMMAND_EXECUTION]: The skill includes shell scripts intended for static verification and contains instructions for their execution during testing.
Evidence: Files evals/activation-cases.md and evals/host-integration/activation-cases.md describe executing bash skills/ui-design/evals/run-static-checks.sh. This script is used for validating file structure and JSON integrity and does not perform any malicious operations.

ui-design