The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from project documentation that could potentially contain malicious instructions intended to influence the agent's behavior.
Ingestion points: scripts/inject-brand-context.cjs reads docs/brand-guidelines.md to build the agent's system prompt context.
Boundary markers: Extracted content is prefixed with BRAND CONTEXT: but lacks explicit delimiters or instructions for the agent to ignore embedded commands within that data.
Capability inventory: The skill scripts have the ability to write to the filesystem (sync-brand-to-tokens.cjs) and execute external Node.js scripts.
Sanitization: The script uses regex to extract specific fields (e.g., hex colors), which provides partial mitigation but remains vulnerable in descriptive text sections.
[DYNAMIC_EXECUTION]: The skill performs cross-skill script execution using relative filesystem paths.
Evidence: scripts/sync-brand-to-tokens.cjs uses execFileSync to execute a script located at a computed path in a sibling design-system skill directory (../../design-system/scripts/generate-tokens.cjs).
[COMMAND_EXECUTION]: The test suite executes shell commands to verify functionality.
Evidence: scripts/tests/test_sync_brand_to_tokens.py uses subprocess.run to call the Node.js interpreter for integration testing.

brand