The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The scripts/inject-brand-context.cjs script parses docs/brand-guidelines.md to extract brand information, including AI image generation templates and personality descriptions, which are then formatted as a system prompt addition. This creates a surface where malicious instructions embedded in the guidelines file could influence the agent's behavior.
Ingestion points: The file docs/brand-guidelines.md is used as the primary data source.
Boundary markers: The extracted content is delimited with headers like 'BRAND CONTEXT' and 'IMAGE GENERATION', but it lacks explicit 'ignore instructions' warnings for content within these blocks.
Capability inventory: The script performs file reads and formats text for standard output to be consumed by the agent.
Sanitization: While regex is used to extract hex colors and font names, the personality and prompt template extractions are less restrictive, allowing arbitrary text interpolation.
[COMMAND_EXECUTION]: The script scripts/sync-brand-to-tokens.cjs uses child_process.execFileSync to execute a script from a sibling skill (design-system/scripts/generate-tokens.cjs). While this is used for legitimate integration, it creates a dependency on the security of the sibling skill's code.
[DYNAMIC_EXECUTION]: The skill relies on Node.js scripts to perform runtime logic, including path resolution and automated sync workflows, which is necessary for its functionality but represents an increased attack surface compared to static instructions.

brand