The Agent Skills Directory

[SAFE]: The skill's functionality is strictly limited to reading and analyzing local Markdown files within the design directory. The tools requested in the frontmatter (Read, Glob, Grep) are appropriate for its stated purpose and do not allow for system modification or data exfiltration. No malicious patterns, obfuscated code, or persistence mechanisms were found.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (UX specification files and configuration documents). Evidence chain analysis: 1. Ingestion points: files processed during Phase 1 (design/ux/*.md) and Phase 2 (.claude/docs/technical-preferences.md). 2. Boundary markers: The instructions do not define specific delimiters to isolate external text from system instructions. 3. Capability inventory: The skill is restricted to read-only file operations. 4. Sanitization: No sanitization is performed on input text. Although the lack of boundaries represents a theoretical surface for indirect prompt injection, the risk is categorized as safe because the agent has no write or network tools to execute harmful actions.

ux-review