The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to offer the installation of the @plannotator/tot NPM package. This package is from a non-standard source that is not recognized as a trusted organization or well-known service.
Evidence: npm install -g @plannotator/tot in SKILL.md.
[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands, including checking for binary existence, installing global packages, and using a CLI tool to upload files.
Evidence: command -v tot, npm install -g @plannotator/tot, and tot path/to/artifact.html in SKILL.md.
[DATA_EXFILTRATION]: The skill encourages the agent to publish generated HTML artifacts to a public web service (tot.page) using the tot CLI. Although the instructions state this requires explicit user consent, it establishes a workflow for transferring local project files to an external, publicly accessible server.
Evidence: The section 'After the artifact ships' in SKILL.md and the command tot path/to/artifact.html.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is instructed to ingest and follow guidelines from untrusted local files.
Ingestion points: The skill reads AGENTS.md, CLAUDE.md, DESIGN.md, QUALITY.md, and PRODUCT.md from the project directory to determine styling and behavior.
Boundary markers: The skill notes that authority flows from user instructions to existing project systems, but does not include explicit delimiters or 'ignore' instructions for the content read from these files.
Capability inventory: The agent has the ability to generate HTML code, write files, and execute shell commands for publishing.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the external configuration files before it influences the agent's output.

effective-design-artifact