The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to pass user-provided input (such as product descriptions, aesthetics, and user flows) directly into shell commands as arguments for the search.py script. This practice introduces a risk of command injection if the agent interpolates adversarial strings containing shell metacharacters (e.g., backticks, semicolons, or pipe symbols) without proper escaping.
[INDIRECT_PROMPT_INJECTION]: The skill's design workflow relies on ingesting content from external search results, Figma design context via MCP, and adversarial critiques from sub-agents. This input is used to formulate the final design system, creating an attack surface for indirect prompt injection where malicious instructions could be embedded in the design data or search results.
Ingestion points: Data retrieved via search.py, get_design_context from Figma MCP, and output from variant/critique sub-agents spawned by orchestrate.sh.
Boundary markers: The skill does not provide specific instructions or delimiters to mark these external inputs as untrusted data or to prevent the agent from following embedded instructions.
Capability inventory: The skill possesses significant local system capabilities, including shell execution of Python/Bash scripts, file system write access to ~/.claude-octopus/designs/, and the ability to spawn and orchestrate additional agent instances.
Sanitization: While the persistence script uses tr to sanitize branch names for filenames, there is no evidence of content sanitization or validation for the design data retrieved from external tools before it is processed by the agent.

octopus-ui-ux-design