The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The SKILL.md file contains installation instructions that recommend using sudo apt install python3 on Linux systems. Recommending the use of administrative privileges for environment setup is a risk if not verified by the user.
[INDIRECT_PROMPT_INJECTION]: The skill implements a persistence pattern that creates an attack surface for indirect prompt injection:
Ingestion points: User-provided strings from the query (args.query), project name (args.project_name), and page name (args.page) are ingested through the CLI in scripts/search.py.
Boundary markers: The generated MASTER.md and page override files do not use delimiters or instructions to treat interpolated user content as untrusted data.
Capability inventory: The skill has the capability to write to the local filesystem via the persist_design_system function in scripts/design_system.py.
Sanitization: There is no escaping or sanitization of the user input before it is written into rule files that the AI agent is explicitly instructed to follow as a "Source of Truth" or for "hierarchical retrieval."
[DATA_EXFILTRATION]: The file persistence mechanism in scripts/design_system.py is vulnerable to path traversal. The script constructs file paths using user-provided strings for the project slug and page filename (f"{page.lower().replace(' ', '-')}.md"). Since it only replaces spaces with dashes and does not strip path traversal sequences (e.g., ../../), an attacker could provide a malicious project or page name to write files to arbitrary locations outside the intended design-system/ directory.
[COMMAND_EXECUTION]: The skill's primary workflow involves the agent executing local Python scripts (python3 skills/ui-ux-pro-max/scripts/search.py) with arguments derived from user requests. While this is the intended functionality, it grants the agent capability to interact with the local environment.

ui-ux-pro-max