The Agent Skills Directory

[PROMPT_INJECTION]: The $ARGUMENTS variable is interpolated directly into the instruction flow without delimiters or context anchoring. This allows user-provided input to potentially override the skill's logic or bypass safety instructions.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from multiple sources which could contain malicious instructions:
Ingestion points: The skill reads BRAND.md and content from src/data/*.ts (which originates from a cloned external website).
Boundary markers: There are no explicit delimiters or instructions for the agent to ignore potential commands embedded within these files.
Capability inventory: The agent has the ability to execute shell commands (npm run dev, npm run build, node scripts/extract/screenshot.mjs) and perform broad file writes across the repository.
Sanitization: No sanitization or validation of the ingested text is performed before it is used to influence the agent's rewrite process.
[COMMAND_EXECUTION]: The skill invokes local shell commands for building the project and taking screenshots. While these appear to be standard development tasks, the security of these operations depends entirely on the integrity of the local scripts (scripts/extract/screenshot.mjs) and the package.json scripts.

restyle