The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface due to its role as a router that aggregates and interpolates untrusted data into instructions for downstream skills.
Ingestion points: The skill reads project-level configuration files (PRODUCT.md, VOIS.md, DESIGN.md) and user-supplied content such as Jira/ADO tickets and feature briefs.
Boundary markers: The templates used for "context packaging" (e.g., the Full-Chain sequence in SKILL.md) lack structural delimiters like XML tags or explicit "ignore" instructions to separate the untrusted input from the agent's instructions.
Capability inventory: The skill possesses file-reading and file-writing capabilities (for session state and setup files) and coordinates multiple specialized design skills.
Sanitization: There are no instructions for sanitizing, escaping, or validating the input data before it is passed to the next skill in the chain.
[COMMAND_EXECUTION]: The skill includes instructions to perform discovery on the local file system by scanning the project's codebase.
Evidence: In references/context-layer.md, the agent is directed to "scan your codebase for existing tokens" by searching through CSS custom properties, Tailwind configurations, and component files. This requires broad file system traversal and content analysis.
[DATA_EXFILTRATION]: While intended for design system setup, the "codebase scanning" process instructions to "extract token values" could theoretically lead to the accidental exposure of sensitive security credentials if the agent misidentifies design tokens, though the primary intent appears benign.

vois-router