The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions utilize strong directives such as "You do not ask questions" and "Do NOT ask the user questions" to ensure fully autonomous operation. While intended to minimize user friction during the polish process, this removes human-in-the-loop checkpoints for the agent's code modifications.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes the entire codebase, which could contain adversarial instructions in comments or string literals.
Ingestion points: Reads all style files, theme files, component files, and package manifests (SKILL.md).
Boundary markers: Absent; the agent lacks instructions to distinguish between design data and potential embedded instructions.
Capability inventory: Broad file-write permissions and the ability to execute shell-based build/linter commands (SKILL.md).
Sanitization: No sanitization or validation is performed on the code content before it is processed by the model.
[COMMAND_EXECUTION]: The skill is designed to execute project build commands (e.g., npm run build, flutter build) and linter tools to validate its changes. This involves executing arbitrary scripts defined in the user's project configuration, which is a standard development workflow but carries the inherent risk of executing malicious local build scripts.

design-polish