The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automatically detects and executes build/compile commands from project files such as package.json, Makefile, and pubspec.yaml during the 'Self-Healing Validation' phase (Phase 5.1). This poses a risk if these files contain malicious scripts, as the agent is instructed to run them up to three times without seeking user confirmation.
[PROMPT_INJECTION]: The skill explicitly instructs the agent to operate autonomously: "ship production-grade... UI code — without asking a single question" and "Do NOT ask the user questions." This suppression of the human-in-the-loop mechanism significantly increases the impact of other vulnerabilities, as malicious actions may proceed without oversight.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by ingesting untrusted data from the local development environment to define its tasks.
Ingestion points: The agent reads $ARGUMENTS, the CLAUDE.md file, TODO comments, and general codebase files to "infer intent" and identify components to build.
Boundary markers: Absent. The instructions do not specify any delimiters or safety warnings to distinguish between system instructions and data retrieved from the codebase.
Capability inventory: The skill possesses file system read/write capabilities and shell command execution (via build scripts).
Sanitization: Absent. There is no mention of validating or filtering the content retrieved from codebase files before it is used to influence the agent's behavior.

design-build