The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is instructed to "read the entire codebase" and "scan all style files, theme files, and component files" to discover design patterns. This create a surface for indirect prompt injection where malicious instructions could be embedded in code comments or metadata.
Ingestion points: The entire project directory, including package manifests (package.json, pubspec.yaml) and all source files related to the UI layer.
Boundary markers: The skill lacks explicit instructions to ignore or treat content within the files as untrusted data, increasing the risk that the agent may follow instructions found within the code it is auditing.
Capability inventory: The agent possesses file-write permissions to apply fixes (Phase 9) and shell execution capabilities for build verification and accessibility checks (Phase 10).
Sanitization: There are no defined sanitization steps for the data processed from the codebase.
[COMMAND_EXECUTION]: In Phase 10, the skill automatically executes shell commands to verify the build, such as npm run build or flutter build. While intended for validation, executing commands defined in project manifests without human oversight could lead to the execution of malicious scripts if the project files themselves are compromised.
[DATA_EXPOSURE]: The skill requires recursive read access to the entire codebase. Although this is necessary for its primary function of design polishing, it provides the agent with access to potentially sensitive configuration files, build manifests, and business logic that may be irrelevant to the UI audit.

design-polish