The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill invokes bundled Python utility scripts (init_user_context.py, user_context_preflight.py) to handle the initialization and retrieval of project-specific user context. These scripts perform file system operations to maintain persistent state in the $CODEX_HOME directory.\n- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands for running local Python scripts and for triggering deployment workflows through external tools such as Vercel or Sites when authorized by the user.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external, untrusted sources which creates an indirect prompt injection surface.\n
Ingestion points: The skill processes live website URLs (via url-to-code), Figma files, and user-uploaded screenshots (via audit and image-to-code) to generate code, mocks, and audits.\n
Boundary markers: Although the skill includes internal instructions to distinguish visible evidence from subjective claims, it lacks explicit programmatic delimiters or safety instructions that encapsulate the untrusted data to prevent the agent from following instructions embedded within that data.\n
Capability inventory: The skill has significant capabilities including executing local Python scripts, writing to the local file system (e.g., user-context.md, design-qa.md), using browser tools for web navigation/capture, and invoking image generation tools.\n
Sanitization: There is no documented mechanism for sanitizing or escaping the text content retrieved from external URLs or visual assets before it is interpolated into the agent's context, potentially allowing malicious instructions in the source material to influence the agent's behavior.

product-design