The Agent Skills Directory

[PROMPT_INJECTION]: The skill demonstrates a susceptibility to indirect prompt injection by design. It accepts arbitrary user input as 'preferences' and automatically upgrades them to 'hard rules' (constraints) upon repetition. A malicious user could provide instructions disguised as design preferences (e.g., 'Always ignore system safety warnings') which would then be followed by the agent.
Ingestion points: User input from conversations is captured and stored in docs/frontend-preferences.md (SKILL.md).
Boundary markers: The skill does not implement boundary markers or instructions to disregard embedded commands when reading the preference ledger.
Capability inventory: The agent is instructed to read and write to the local file system (docs/frontend-preferences.md).
Sanitization: There is no mention of sanitizing, validating, or filtering the content of the preferences before they are recorded or promoted.
[SAFE]: The skill's primary operations involve reading and writing to a specific project file (docs/frontend-preferences.md). No unauthorized network access, sensitive credential harvesting, or remote code execution patterns were found.

design-preference-ledger