The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes instructions to be 'FULLY AUTONOMOUS' and explicitly forbids the agent from asking the user questions ('Do NOT ask the user any questions'). This concealment pattern effectively removes human oversight during high-impact operations like mass file modification and automated code deployment.
[COMMAND_EXECUTION]: In Phase 4, the skill instructs the agent to detect and execute the project's own build and test commands. This creates a risk of executing malicious code if the local environment or project configuration files (e.g., package.json scripts) have been tampered with.
[COMMAND_EXECUTION]: Phase 5.2 commands the agent to 'Push all commits to the current branch' without manual review or confirmation, which could result in unintended or destructive changes being committed to the remote repository.
[PROMPT_INJECTION]: The skill uses the '$ARGUMENTS' variable directly in the target definition without sanitization, which could lead to prompt injection or scoping errors if malicious arguments are provided.
[DATA_EXFILTRATION]: The skill automatically writes execution telemetry to a local file in the '~/.claude/projects/' directory, performing automated data collection and local storage without explicit user notification.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes an entire UI codebase (Phase 0.1) without boundary markers or sanitization, while possessing high-impact capabilities. 1. Ingestion points: Full UI codebase scan (Phase 0.1). 2. Boundary markers: Absent. 3. Capability inventory: Codebase-wide file modification (Phases 1-3), Build and test script execution (Phase 4), and Git push operations (Phase 5). 4. Sanitization: Absent.

design-overhaul