The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to ingest and process external data from the Sleek API, including JSON run results and HTML component code, to implement designs or generate code. This creates a surface for indirect prompt injection where malicious instructions embedded in the design data could influence the agent's actions during the implementation phase.
Ingestion points: API responses from https://sleek.design (JSON, HTML) saved to local files.
Boundary markers: The skill does not provide specific delimiters or instructions for the agent to ignore potentially malicious embedded content within the design data.
Capability inventory: The agent has capabilities to write files (saving HTML, JSON, and SVG assets) and perform network operations (curl).
Sanitization: No sanitization or validation of the fetched HTML/JSON content is specified before it is processed by the agent.
[COMMAND_EXECUTION]: The skill instructs the agent to use shell commands (e.g., curl -o run.json) to fetch API responses and write them directly to disk. While used for legitimate data transfer, this utilizes the agent's command execution capabilities.
[EXTERNAL_DOWNLOADS]: The skill fetches assets and data from external sources, specifically https://sleek.design for design data and https://api.iconify.design for icon SVGs. These are vendor-owned or well-known services used for their intended purpose.

sleek-design-mobile-apps