The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from external Figma URLs and remote websites to guide its UI implementation phase. This creates an attack surface where a malicious design reference could attempt to inject instructions into the subagent's implementation context.
Ingestion points: Figma URLs, remote design URLs, and local screenshot paths extracted in Phase 1 and used in Phase 2.
Boundary markers: The skill uses structured Task prompts to define subagent missions but does not include explicit delimiters or instructions to ignore potential commands embedded within the design assets themselves.
Capability inventory: The subagents are granted capabilities to write files to the filesystem and execute shell commands (npm run build, npm run lint, npx tsc) via the Bash tool.
Sanitization: Phase 1, Step 6 validates input formats (e.g., verifying a Figma URL format) but does not sanitize the content fetched from those URLs for potential injection attacks.
[COMMAND_EXECUTION]: The skill instructs agents to run shell commands including npm run build, npm run lint, and npx tsc --noEmit. While these are standard for UI development, they execute scripts defined in the local environment's package.json, which could be a vector for privilege escalation or data access if the environment is pre-compromised or the project configuration is manipulated.

ui-implementer