The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted screenshots and URLs which could potentially contain malicious text instructions designed to subvert agent behavior.
Ingestion points: Untrusted screenshot files and live URLs are processed as described in SKILL.md and references/extraction-guide.md.
Boundary markers: The skill includes a dedicated 'Prompt Injection Boundary' section in SKILL.md that explicitly instructs the agent to treat extracted content as data rather than instructions.
Capability inventory: The skill utilizes file system access (Read, writing JSON files), network browsing via the /browse tool, and repository management via git, gh CLI, and npm scripts.
Sanitization: Relies on internal LLM guardrails and the specific instruction to treat visual content as descriptive data rather than executable commands.

design-extractor