The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository to detect and adopt existing design systems.
Ingestion points: The agent is instructed in SKILL.md to scan for tailwind.config.*, components.json, CSS custom properties, and native platform systems.
Boundary markers: The instructions tell the agent to "invent nothing" and "Return the tool, the token values found", but they lack explicit boundary markers or instructions to ignore potential natural language commands embedded within those configuration files.
Capability inventory: The skill has access to Write, Edit, Bash, and Skill tools, allowing it to modify files or execute commands based on interpreted data.
Sanitization: No sanitization is applied to the content read from the repository files before it is processed by the agent.
[COMMAND_EXECUTION]: The skill executes local Python scripts (scripts/dtcg_validate.py and scripts/contrast.py) to validate token schemas and check accessibility compliance.
[EXTERNAL_DOWNLOADS]: The skill invokes the @google/design.md CLI tool using npx if the --with-design-md flag is provided. This tool originates from a trusted organization.

product-design-tokens