The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from a specific local project file which could be manipulated to inject malicious instructions into the agent's context.
Ingestion points: SKILL.md explicitly directs the agent to include .claude/apple-design-context.md if present and "follow current user instructions" found within it.
Boundary markers: Absent. There are no instructions to use delimiters or warnings to treat the file content as untrusted.
Capability inventory: The skill consists of documentation only and contains no scripts, CLI calls, or executable code.
Sanitization: Absent. The instructions do not mention validating or filtering the content of the external context file.
[METADATA_POISONING]: The skill metadata contains an explicit safety claim that could influence security assessments.
Evidence: The YAML frontmatter in SKILL.md includes the field risk: none. This is a self-reported assessment that does not account for the indirect prompt injection surface.

hig-components-menus