The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from multiple sources to generate persistent guidelines.
Ingestion points: The skill allows users to provide local file paths (e.g., ./brand-deck.pdf), remote URLs (e.g., https://acme.com/brand), and pasted text for extraction as seen in SKILL.md and references/wizard-questions.md.
Boundary markers: The instructions do not specify any delimiters or warnings to the agent to ignore instructions that might be embedded within the ingested brand documents.
Capability inventory: The skill relies on the agent's ability to read local files, fetch content from network URLs, and write files to the local directory ~/Documents/Brand Guidelines/.
Sanitization: There is no mention of sanitizing or validating the extracted content before it is saved into the brand guidelines file, which is then consumed by other agents.
[COMMAND_EXECUTION]: The skill facilitates file system interaction by directing the agent to read user-provided file paths and write generated content to the user's home directory. While functional, this requires the agent to handle user-supplied paths that could potentially target sensitive files if manipulated.
[EXTERNAL_DOWNLOADS]: The skill includes functionality for the agent to fetch remote content and download logo files from URLs provided by the user, which is a standard part of its onboarding workflow but depends on the reputation of the external sources.

brand-onboarding