The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by instructing the agent to ingest external documentation and use it to drive automated code modifications.
Ingestion points: The agent is instructed to process content from design.md, design tokens, and existing codebase stylesheets/themes as defined in SKILL.md.
Boundary markers: There are no instructions for using specific delimiters or "ignore embedded instructions" warnings when the agent reads the design documents.
Capability inventory: The skill explicitly grants the agent the capability to modify project code, stating that "when a screen disagrees with [the design skill], the screen is fixed."
Sanitization: The instructions do not include methods for sanitizing or validating the contents of the design documents before the agent acts upon them, although it suggests offloading measurable rules to a structured kero-audit.json file.

kero-system