The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources which could be used to influence agent behavior through indirect prompt injection.
Ingestion points: Project documentation (AGENTS.md, CLAUDE.md), subject source code (analyzed in Step 3), and the Claude artifact database (picks/main) used for selection persistence.
Boundary markers: The instructions do not define specific delimiters or "ignore" instructions for the project files it reads, leaving it vulnerable to instructions hidden in code or documentation.
Capability inventory: The skill has the ability to execute shell commands for development (Step 1), write code changes to the filesystem (Step 8), and perform browser automation (capture.md).
Sanitization: While finding descriptions are escaped in the HTML template, the pv (preview) property allows for raw HTML injection into the generated report, which is then rendered as an artifact.
[COMMAND_EXECUTION]: The skill is designed to discover and execute arbitrary shell commands (e.g., dev servers, build commands) based on its reading of local project documentation. This allows for execution of local code defined within the project scope.
[DYNAMIC_EXECUTION]: The skill assembles an interactive HTML report by populating a template (assets/critique-page.html) with data generated during the critique. This process includes injecting raw HTML snippets into visual preview boxes which are executed/rendered within the agent's interface.

design-critique