The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from the project being critiqued to generate design findings and improvement ideas. A malicious project could attempt to influence the agent's analysis to generate harmful implementation suggestions.
Ingestion points: Source code files of the subject project, configuration files such as AGENTS.md and CLAUDE.md, and live browser content/DOM measurements during the capture phase (detailed in SKILL.md Steps 3-4 and references/capture.md).
Boundary markers: The skill uses a specific trigger phrase (Implement these <subject> ideas:) to identify user-approved changes, but it lacks explicit instructions or delimiters to isolate the agent from adversarial content embedded in the codebase being audited.
Capability inventory: The agent has extensive capabilities including writing and modifying project source code, committing changes to a repository, and executing shell commands to start development servers or build processes (described in Step 1 and the 'After the picks come back' section of SKILL.md).
Sanitization: While the generated HTML page employs standard character escaping for display purposes, there is no semantic sanitization or validation to ensure that the logic within the generated 'Ideas' has not been manipulated by the untrusted source code.
[COMMAND_EXECUTION]: The skill requires the agent to identify and execute shell commands to run the project's development server, perform builds, and drive a headed or headless browser for screenshot capture (Step 1 and Step 2 of SKILL.md). These commands are dynamically sourced from project documentation or user instructions.
[EXTERNAL_DOWNLOADS]: The generated critique page (assets/critique-page.html) fetches styling assets and fonts from Google's well-known font service (fonts.googleapis.com and fonts.gstatic.com).

zk-design-critique