The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to derive visual and functional direction by inspecting conversation history, external references, and project files. This data ingestion surface is vulnerable to indirect prompt injection if those external sources contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The SKILL.md file specifies: 'Inspect the conversation, supplied references, and project before designing. Look for design-system documentation, tokens, existing components, product screenshots, and nearby artifacts.'
Boundary markers: There are no explicit instructions or delimiters provided in the prompt to help the agent distinguish between design data and potentially malicious embedded instructions in the ingested sources.
Capability inventory: The skill allows the agent to generate and deliver interactive HTML/JavaScript files, which could contain malicious scripts if the generation process is influenced by an injection.
Sanitization: The instructions do not define any sanitization, validation, or filtering requirements for the ingested context.

html-prototype