The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted design documents from the ./design directory which can contain malicious instructions. The agent is instructed to read these files before generating the viewer, creating a surface for indirect prompt injection from data.
Ingestion points: Markdown files located in ./design/, ./design/components/, and ./design/GLOBAL.md are read by the agent and the generation script.
Boundary markers: The script lacks explicit delimiters or instructions to ignore commands embedded within the design files.
Capability inventory: The skill has the ability to write a local HTML file and trigger a browser preview via the Browser Use tool.
Sanitization: Incomplete sanitization allows untrusted data to influence the final executable output.
[DYNAMIC_EXECUTION]: The scripts/generate_wireframe.py script generates an HTML file that incorporates untrusted input into a JavaScript block, creating a Cross-Site Scripting (XSS) vulnerability.
Evidence: In scripts/generate_wireframe.py, the build_html function embeds a JSON string into a <script> tag using json.dumps without escaping the </script> sequence. This allows an attacker to include a terminating script tag and a new malicious script block in a design file (e.g., </script><script>alert(1)</script>).
Risk: When the agent or user previews the generated wireframe, the injected JavaScript will execute in the browser context, potentially allowing for data exfiltration or session manipulation.

wireframe