The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The automated detector and hook scripts create a surface where untrusted data (project code) is ingested and repeated back to the agent.
Ingestion points: scripts/detect.mjs and scripts/hook.mjs read file contents from the user's workspace using standard file system operations.
Boundary markers: The scripts use logical delimiters like "vois-tokens:" and structured formatting, but they do not enforce strict isolation or ignore-instruction warnings for the content being analyzed.
Capability inventory: The findings, including raw code snippets, are printed to stdout and processed by the AI agent to provide feedback to the user.
Sanitization: Extracted code snippets are included in the output messages without escaping, which could allow adversarial code in the analyzed files to influence the agent's behavior when it processes the linting results.
[PERSISTENCE]: The skill includes a utility scripts/hook-admin.mjs designed to install automated triggers in the user's environment.
Mechanism: The script modifies platform-specific configuration files such as .claude/settings.json, .cursor/hooks.json, and .codex/hooks.json to register the skill's linting scripts as hooks.
Context: This is a core, documented feature intended to provide continuous design system enforcement throughout a development session.

vois-tokens