The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to override the agent's default safety behavior regarding user confirmation. Directives such as 'You are in AUTONOMOUS MODE. Do NOT ask questions' and 'Execute the full pipeline below without pausing for user input' are designed to bypass the human-in-the-loop safety mechanism.
[COMMAND_EXECUTION]: The skill automates the execution of several CLI tools, including flutter analyze, tsc --noEmit, stylelint, and eslint. These tools are executed as part of a self-healing loop that performs automated code modifications across the entire project.
[INDIRECT_PROMPT_INJECTION]: The skill has a high-exposure surface for indirect injection by processing untrusted data (source code) and using it to drive automated code writes.
Ingestion points: Scans the entire source tree for design values (Phase 2).
Boundary markers: No delimiters or safety instructions are provided to the agent to distinguish between design data and potentially malicious instructions embedded in comments or strings within the scanned files.
Capability inventory: Possesses comprehensive write access to all files in the project (Phase 6 remediation) and the ability to execute shell commands for verification.
Sanitization: The skill lacks sanitization logic to ensure that extracted values do not contain executable logic or instructions.
[PERSISTENCE]: The skill includes a 'Self-Evolution Telemetry' mechanism that writes execution metadata to ~/.claude/projects/skill-telemetry.md. Accessing and modifying files in a hidden directory outside the immediate project workspace is a persistence-like behavior used for cross-session tracking.

design-system