The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites when auditing design systems. A malicious site could embed hidden instructions in metadata, heading tags, or ARIA labels to manipulate the agent's review or influence subsequent steps in the workflow.
Ingestion points: SKILL.md (Step 1: Capture Current State) instructs the agent to fetch page titles, meta descriptions, heading hierarchies, and navigation structures from a user-provided URL.
Boundary markers: Absent. There are no instructions or delimiters defined to help the agent distinguish between its core instructions and the untrusted data it is analyzing.
Capability inventory: The skill has the ability to write files to the .sage/work/ directory and execute shell commands for screenshot capture.
Sanitization: Absent. No specific validation or escaping mechanisms are mentioned for the content extracted from external URLs.
[COMMAND_EXECUTION]: The skill invokes a shell script, sage/runtime/tools/sage-screenshot.sh, to perform visual audits. This tool takes an external URL as a parameter. While this is a functional part of the skill's UX audit purpose, it represents a direct interface between external input and local command execution.

ux-review