The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from various file types in the codebase, creating a surface for indirect prompt injection.
Ingestion points: Scans and reads .css, .scss, .json, .yaml, .js, and .ts files throughout the project. It also pulls data from Figma and GitHub APIs.
Boundary markers: The skill lacks explicit boundary markers or instructions for the agent to ignore potential commands embedded within the token values or comments in these files.
Capability inventory: The skill has the ability to write files (audit reports), execute shell commands via Bash tools, and run external tools via npx.
Sanitization: There is no mention of sanitizing or validating the input data to prevent embedded instructions from being followed by the agent.
[COMMAND_EXECUTION]: The skill invokes npx style-dictionary and npx terrazzo. These commands execute external tools on files present in the repository, which could be exploited if the configuration files for these tools are maliciously modified.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx for tool execution, which may trigger downloads from the public npm registry. It also facilitates data retrieval from GitHub and Figma through their respective APIs.

token-audit