The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install a global NPM package @plannotator/tot from an external registry. While the instructions require the agent to ask for user permission first, this involves downloading and executing code from an unverified third-party source.
[DATA_EXFILTRATION]: The skill facilitates the uploading of local HTML artifacts to a public web service (tot.page) using the tot CLI tool. The instructions correctly state that such pages become publicly accessible, but this still constitutes a mechanism for moving local data to an external network location.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted project documentation and user-provided briefs which could contain malicious instructions.
Ingestion points: Processes project-specific metadata and styling files such as AGENTS.md, CLAUDE.md, DESIGN.md, and QUALITY.md (SKILL.md).
Boundary markers: None present to distinguish between systemic instructions and data-provided instructions.
Capability inventory: Global package installation (npm install -g), external network transmission (tot CLI), and file system access.
Sanitization: No explicit sanitization or validation of the content read from external project files is specified.

design-artifact