The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md under the 'Design Intelligence' section define a shell command template: python3 -m form_agent.uiux search --domain color --query "{industry/product_type}". The placeholder {industry/product_type} is intended to be filled with untrusted user input collected in Phase 1. An attacker providing a product description containing shell metacharacters (e.g., ;, &&, or backticks) could achieve arbitrary command execution on the host environment when the agent invokes the Bash tool.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to the lack of sanitization and structural separation of user data.
Ingestion points: Untrusted data enters the context through user responses in Phase 1 (Product and Industry descriptions) in SKILL.md.
Boundary markers: No delimiters, XML tags, or 'ignore embedded instructions' prompts are used to isolate user-provided data from the agent's logic.
Capability inventory: The skill possesses significant capabilities, including the Bash, Write, and Edit tools, which increases the impact of a successful injection.
Sanitization: The skill lacks any explicit validation or escaping logic to ensure that user-provided text does not contain malicious instructions or shell-breaking characters.

form-brand