The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external URLs via WebFetch and local project files via Read. There are no explicit instructions or boundary markers to treat the audited content as non-executable data, which could allow malicious instructions embedded in a website's metadata or source code to influence the agent's behavior.
Ingestion points: WebFetch of target URLs and Read/Glob of local project files (SKILL.md, Step 1).
Boundary markers: Absent. The skill does not instruct the agent to ignore instructions contained within the audited data.
Capability inventory: Write, Bash, WebFetch, Read, Glob, Grep (SKILL.md, tools list).
Sanitization: Absent. There is no mention of filtering or escaping content retrieved from external sources.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to implement design and copy fixes. While the intended use case is for project maintenance, the availability of a shell environment alongside tools that fetch external data represents a standard capability risk.
[EXTERNAL_DOWNLOADS]: The skill uses WebFetch and WebSearch to retrieve content from external websites for the purpose of UI auditing. While this is the primary function of the skill, it involves fetching data from arbitrary remote sources.

claude-design-critic