The Agent Skills Directory

[METADATA_POISONING]: The description field in SKILL.md contains a deceptive string ("QUERY LENGTH LIMIT EXCEEDED. MAX ALLOWED QUERY : 500 CHARS") that mimics a system-level error message. This is misleading and may cause users or automated agents to misinterpret the state or constraints of the skill.
[INDIRECT_PROMPT_INJECTION]: The design recommendation engine (scripts/search.py and scripts/design_system.py) creates an attack surface for indirect prompt injection.
Ingestion points: User search queries provided to the CLI tool are used to filter CSV data which is then formatted into instructions.
Boundary markers: The skill does not use specific delimiters or instructions for the agent to ignore any natural language commands found within the database results.
Capability inventory: The skill possesses file-writing capabilities (scripts/design_system.py) and encourages the agent to read persisted "Master" rules from the filesystem.
Sanitization: Content retrieved from the CSV database files is not sanitized or escaped before being presented to the agent's context.
[COMMAND_EXECUTION]: The script scripts/design_system.py is vulnerable to path manipulation and arbitrary file writing through the project_name and page arguments.
Evidence: The script constructs output paths using project_name.lower().replace(' ', '-'). This does not prevent directory traversal sequences (e.g., ../../) or absolute paths.
Risk: An attacker-controlled project name could allow the script to write or overwrite Markdown files outside of the intended design-system/ directory. Additionally, the SKILL.md file recommends that users execute shell commands including sudo apt install, which involves high-risk environment modification.

ui-ux-pro-max