The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to read and analyze local source code, which creates a vulnerability to indirect prompt injection if those external files contain malicious instructions intended to manipulate the agent's behavior.
Ingestion points: The skill uses Read, Glob, and Grep tools (as defined in SKILL.md) to examine component files and directory structures.
Boundary markers: The instructions do not specify any delimiters or safety prompts to isolate analyzed code content from the agent's core instructions.
Capability inventory: The skill is configured with Bash and WebFetch permissions, which could be misused if an injection attack successfully overrides the agent's persona constraints.
Sanitization: There is no evidence of content filtering or sanitization being applied to the files read by the agent before they are processed by the model.

frontend-expert