The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is configured to ingest instructions from an external file titled brand-context.md found in the user's project root or subdirectories. The SKILL.md file explicitly directs the agent to let the "Rules for agents reading this file" section within that external document "override an agent's own defaults." This creates a significant surface for indirect prompt injection, as any user or process capable of placing a file in those locations could hijack the agent's behavior.
Ingestion points: The agent reads brand-context.md from ./, ./.claude/, or ./docs/.
Boundary markers: No delimiters are specified to separate instructions from data within the ingested file.
Capability inventory: The skill generates creative assets and design specifications; no direct command execution or network exfiltration tools are defined in the analyzed files.
Sanitization: While the skill instructs agents not to invent facts, it lacks mechanisms to filter or sanitize instructions that attempt to redefine agent behavior.
[INDIRECT_PROMPT_INJECTION]: The skill instructions suggest generating content by reading the user's "website and existing content." If the agent uses a tool to fetch external web data, this introduces a secondary vector where malicious instructions hidden on a website could influence the agent.

design-ops