The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The hallmark study feature (defined in references/study.md) allows the agent to fetch and process content from external URLs to extract design metadata. The skill possesses extensive capabilities, including file modification and local shell execution of Python and Node.js scripts (as seen in SKILL.md RULE-08, RULE-14, and RULE-16). While the skill includes instructions to treat remote content as untrusted and ignore embedded directives, the lack of formal structural isolation or programmatic filters for the ingested HTML/CSS presents a potential surface for indirect prompt injection attacks.
[COMMAND_EXECUTION]: The skill automates design quality and consistency checks by executing several local utility scripts via python3 and node, such as harness/scripts/design-variety.py, fdk/tools/build-design-showcase.py, and fdk/tools/button-harmony.mjs. These tools are part of the skill's provided harness and are used to ensure that generated designs meet specific standards. While standard for advanced tools, shell execution of local files remains a sensitive capability that should be monitored.

hallmark