The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script search-slides.py located at .claude/skills/design-system/scripts/. This script is not included in the provided file list and resides in a different skill's directory, representing a dependency on external code that could be modified independently of this skill.
[EXTERNAL_DOWNLOADS]: The html-template.md file includes a script tag that fetches the Chart.js library from https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js. While this is a well-known content delivery network, it represents an external dependency loaded at runtime.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted user data via $ARGUMENTS in references/create.md and uses it to generate HTML presentations.
Ingestion points: User-provided arguments are captured in the references/create.md file within a <task> tag.
Boundary markers: The skill uses <task> tags to encapsulate the user input, which provides some context but does not prevent adversarial instructions from influencing the agent's behavior during HTML generation.
Capability inventory: The agent has the capability to execute shell commands (Python scripts) and generate files (HTML/CSS/JS).
Sanitization: There is no evidence of input validation, escaping, or sanitization performed on the $ARGUMENTS before they are processed by the agent.

slides