The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes workflows where the agent is instructed to read and act upon content from external files, specifically requirement documents (docs/requirements/), design specifications (docs/design/), and project task logs. This creates a vulnerability surface where instructions hidden within these external data sources could potentially override agent behavior.
Ingestion points: Requirement files, UI design files, and documentation in the docs/ and designs/ directories.
Boundary markers: The instructions do not define specific delimiters or instructions to prevent the agent from obeying commands embedded within these processed files.
Capability inventory: The skill provides instructions for the agent to perform file system operations (writing tasks, creating project structures), execute shell commands via package managers (npm create vite), and utilize external UI tools through MCP integrations.
Sanitization: There are no requirements for the agent to sanitize or validate the content of external documents before following the workflows outlined in the skill.
[SAFE]: The coding-standards.md file mandates the protection of sensitive information by explicitly forbidding the hardcoding of passwords, API keys, or tokens, and requiring their management through environment variables.
[EXTERNAL_DOWNLOADS]: The skill references established development tools and services, such as the Vite build tool and the Pencil UI design application. These are well-known services within the development ecosystem and are utilized according to their standard purposes.

rules