The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository files and external URLs, which constitutes a surface for indirect prompt injection.
Ingestion points: SKILL.md specifies reading repository code (styles, tokens) and external website content (rendering, DOM, CSS).
Boundary markers: The instructions lack strict structural delimiters or safety prompts to isolate untrusted data from agent instructions, although they suggest labeling external observations as "drafts."
Capability inventory: The skill has the ability to write to the local filesystem (DESIGN.md) and execute shell commands.
Sanitization: There are no instructions for sanitizing or escaping ingested data before it is presented to the agent's context.
[COMMAND_EXECUTION]: The skill utilizes command-line tools for processing documents and gathering project context.
Runs npx @google/design.md for document linting and export tasks (references/format.md).
Uses a phoenix-ui CLI tool to extract project-specific information (SKILL.md).
Contains shell and Python scripts in evals/fresh-context.md for environment setup and automated testing.
[EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and execute the official @google/design.md package from the npm registry. This resource is provided by a well-known organization.
[DYNAMIC_EXECUTION]: The evals/fresh-context.md file includes embedded scripts that are dynamically executed during the skill's maintenance and evaluation cycles.

design-md