The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from the user and external files, then passes it verbatim to sub-agents (ui-analyzer, work-planner) without sanitization or protective boundary markers.
Ingestion points: The $ARGUMENTS variable in SKILL.md and the content of docs/project-context/external-resources.md are used directly in sub-agent prompts.
Boundary markers: Absent. The instructions use placeholders like [verbatim] and [adjustment request] without delimiters (e.g., XML tags or triple quotes) to prevent the data from being interpreted as instructions by the sub-agents.
Capability inventory: The skill can spawn new agents, read and write files ("Apply the edit"), and execute local development tools (test runners, Storybook).
Sanitization: No validation or escaping of the user input or external resource content is performed before interpolation.
[COMMAND_EXECUTION]: The execution flow involves running local development and verification tools such as a browser, test runner, Storybook, and dev server in the parent session. While legitimate for a frontend adjustment skill, this capability could be abused if a sub-agent is manipulated via prompt injection to run malicious commands.

recipe-front-adjust