The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads external files within the repository, specifically DESIGN.md and various component files, to establish design constraints and 'taste'. This ingestion of local data serves as an attack surface where malicious instructions embedded in the project files could influence the agent's behavior during UI generation.
Ingestion points: The skill reads the root-level DESIGN.md, component directories, components.json, and theme configuration files (e.g., @theme, :root custom properties).
Boundary markers: The instructions do not explicitly define delimiters or require the agent to ignore embedded prompts/instructions within the files it reads from the repository.
Capability inventory: The agent is authorized to use Write, Edit, and Bash tools. This allows it to modify source code and execute shell commands based on the design logic it derives from processed files.
Sanitization: No specific sanitization, filtering, or validation steps are mentioned for the content retrieved from the project's documentation or source files.

uikit