The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-defined design tasks and retrieves information from external websites (e.g., lawsofux.com, nngroup.com). This creates an attack surface where malicious instructions embedded in external content or user inputs could potentially influence the agent's behavior.
Ingestion points: User-supplied design descriptions, surface types, and parameters used to build external research URLs in SKILL.md.
Boundary markers: The skill relies on structured Markdown templates but lacks explicit delimiters or instructions to ignore potential commands within fetched content.
Capability inventory: The skill uses WebFetch for network operations to retrieve documentation.
Sanitization: No specific sanitization or filtering of the content retrieved via WebFetch is documented before the agent processes it.
[EXTERNAL_DOWNLOADS]: The skill is configured to fetch data from several third-party domains to supplement its local reference files.
Evidence: SKILL.md explicitly lists lawsofux.com, nngroup.com, builtformars.com, and refactoringui.com as targets for the WebFetch tool.
Context: These domains are well-known, authoritative resources for user experience design. Their use is consistent with the skill's primary purpose, and the references are documented neutrally without alarming characteristics.

ux-principles