The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a Python module with an interpolated variable derived from user context.
Evidence: Found in SKILL.md: python3 -m form_agent.uiux design-system --product-type "{product_type}".
Risk: The {product_type} variable is interpolated directly into a shell command. If this variable is populated with malicious input containing shell metacharacters (e.g., command chaining symbols), it could lead to arbitrary command execution.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the lack of boundary markers when processing external user input.
Ingestion points: The {product_type} parameter in SKILL.md used for design system generation.
Boundary markers: Absent. No delimiters or instructions are used to differentiate untrusted input from system commands.
Capability inventory: The skill has access to Bash, Write, Edit, and WebFetch tools.
Sanitization: No sanitization, validation, or escaping logic is described for the interpolated input.
[METADATA_POISONING]: The skill manifest and instruction files contain conflicting version information.
Evidence: SKILL.md identifies as version 0.6.4, while .claude-plugin/plugin.json specifies version 1.9.1.
Risk: Inconsistent metadata can be used to mislead auditors or automated systems regarding the skill's provenance and update status.

form-tokens