The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to "Run the project build command" (Phase 6.3) and "Run all existing tests" (Phase 7.2). This triggers the execution of scripts and binaries defined within the local repository's configuration (e.g., package.json, build.gradle), which represents a path for arbitrary code execution if the codebase is untrusted.
[PROMPT_INJECTION]: The instructions include multiple directives to suppress user interaction, such as "You do not ask questions" and "Do NOT ask the user questions." By removing human-in-the-loop validation for global file modifications and command execution, the skill increases the potential impact of adversarial or erroneous behavior.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process data from the entire codebase, which serves as an untrusted input surface.
Ingestion points: The agent is directed to "Scan every style-containing file" and read project manifests like package.json, pubspec.yaml, and build.gradle (Phases 1.1, 1.2).
Boundary markers: The skill provides no delimiters or instructions for the agent to distinguish between design data and potentially malicious instructions embedded in file comments or metadata.
Capability inventory: The agent possesses full read/write access to the codebase and the authority to execute shell commands via the build and test phases.
Sanitization: There is no evidence of sanitization for the values harvested from the codebase before they are interpolated into new token files or configuration objects.
[DYNAMIC_EXECUTION]: The skill involves the dynamic generation of code—including CSS Custom Properties, JavaScript/TypeScript Tailwind configurations, and Dart code—based on values extracted from the codebase, which are then written to the file system and verified via the project's execution environment.

design-tokens