The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: Phase 3 of the skill uses the WebFetch tool to retrieve content from external URLs provided by the user to serve as design references. This content is processed to identify design patterns such as typography, colors, and layout. The lack of explicit boundary markers or sanitization for this external data creates an attack surface where a malicious website could inject instructions to influence the agent's behavior or the generated output.
Ingestion points: The WebFetch tool is used in Phase 3 to ingest content from arbitrary user-provided URLs (e.g., reference sites like Stripe or Linear).
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the fetched web content.
Capability inventory: The skill has access to Read, Write, Edit, and Skill tools, and it can execute shell commands via the Task tool (implied by the open command instruction).
Sanitization: There is no evidence of sanitization or filtering of the fetched HTML/text content before it is processed by the agent.
[COMMAND_EXECUTION]: In Phase 5, Step 2, the skill instructs the agent to execute a shell command (open <design-system-path>) to preview the generated design system. The file path is determined by reading a configuration file (.agents.yml) or using a default local path. While intended for utility, executing shell commands based on external configuration values is a practice that requires careful validation to prevent command injection.

ux-brief