The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external inputs such as screenshots, Figma links, and product descriptions to audit onboarding flows. This ingestion surface is managed through a structured evaluation process against a fixed set of rule IDs which reduces the risk of arbitrary instruction following from the input data.
Ingestion points: SKILL.md (Mode 1 inputs like Figma/Mobbin links, screenshots, and descriptions).
Boundary markers: The skill requires auditing against specific rule ids from data/onboarding-rules.json which provides a constrained reasoning task.
Capability inventory: The skill uses mcp__Mobbin__search_flows and mcp__Mobbin__search_screens for information retrieval; it produces text-based design critiques and sequences.
Sanitization: Not explicitly present for inputs, but the output format is predefined.
[COMMAND_EXECUTION]: The skill includes scripts/check-rule-sync.mjs, a maintenance script intended for developers to ensure synchronization between the JSON rule definitions and Markdown documentation. The script uses standard, safe Node.js built-ins (node:fs, node:path) to read local files within the skill's directory and does not exhibit malicious behavior or network access.

onboarding-flow