The Agent Skills Directory

[COMMAND_EXECUTION]: The instruction provided in SKILL.md to run python design_system_extractor.py <URL> presents a command injection risk. If the agent executes this shell command using a user-supplied URL without proper escaping or sanitization, it could lead to arbitrary command execution on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external websites via user-provided URLs. This creates a surface for indirect prompt injection, where malicious instructions embedded in the target website's HTML or CSS could influence the agent's behavior.
Ingestion points: Data is fetched from external URLs in tools/design_system_extractor.py and tools/extract_tokens.py.
Boundary markers: While the skill includes instructions for data analysis, it lacks explicit markers or instructions for the agent to ignore potential instructions embedded within the extracted site content.
Capability inventory: The skill enables network requests and shell command execution, and provides instructions for the agent to write files (e.g., design_pattern.html).
Sanitization: The sanitize_html function in tools/design_system_extractor.py mitigates some risk by removing tags such as <script>, <svg>, <noscript>, <style>, and <iframe>.
[SAFE]: The Python script tools/design_system_extractor.py explicitly disables SSL certificate verification (verify=False) and suppresses related warnings. This is a security best practice violation that exposes the tool to Man-in-the-Middle (MITM) attacks, potentially allowing an attacker to intercept or modify the design data fetched from external sites.

design-system-extractor