The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted design metadata from the Penpot workspace and interpolates it into prompts for downstream skills.
Ingestion points: SKILL.md (Phase 0) and references/02-preflight-overview.md define logic to read layer names, page names, and token structures using execute_code discovery calls.
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the ingested design data before constructing the handoff brief.
Capability inventory: Uses the execute_code tool for environmental discovery and session state management.
Sanitization: No evidence of escaping or filtering for layer names or token values that might contain malicious instructions.
[DYNAMIC_EXECUTION]: The skill provides JavaScript templates to be executed via the execute_code tool.
Evidence: Phase 0 discovery logic and breadcrumb recording involve generating and executing small code snippets to query the Penpot API.

penpot-router