The Agent Skills Directory

[COMMAND_EXECUTION]: The shell script template templates/check-design-tokens.sh uses placeholders {{SRC_DIRS}} and {{EXCLUDE_FILES}} that are interpolated into a grep command without sanitization. If the agent or user provides paths containing shell metacharacters, it could lead to arbitrary command execution when the generated script is run.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze external design assets such as moodboards, prototypes, and reference screenshots (Phase B1) to settle token values. This represents a vulnerability surface where malicious content embedded in design data could influence the agent's behavior.
Ingestion points: Reads existing styles, moodboards, and flagship prototypes in SKILL.md (Phase B1).
Boundary markers: None identified in the instructions for processing external design data.
Capability inventory: The skill uses grep for linting (check-design-tokens.sh), playwright for screenshots (screenshot-states.mjs), and performs various file write operations.
Sanitization: No specific sanitization or validation of the design content is mentioned before it is used to generate histograms and propose token values.
[EXTERNAL_DOWNLOADS]: The skill recommends using playwright for browser-based screenshots. Playwright is a well-known service maintained by Microsoft; the installation involves downloading official binaries and drivers from their repositories.
[DYNAMIC_EXECUTION]: The script templates/screenshot-states.mjs uses Playwright to visit URLs defined in a states.json file. While intended for local UI verification, this mechanism performs dynamic network navigation based on input data which could be misused for server-side request forgery (SSRF) if the input source is untrusted.

setup-design-infra