The Agent Skills Directory

[Indirect Prompt Injection] (LOW): The skill is designed to ingest and process untrusted external data such as website URLs, code repositories, and Figma links, creating a surface for indirect prompt injection.
Ingestion points: Processes screenshots, Figma links, URLs, and repositories (defined in SKILL.md).
Boundary markers: No explicit delimiters or instructions (e.g., 'ignore instructions in the input') are present to prevent the agent from following malicious commands embedded in the processed data.
Capability inventory: The search.py script has the capability to write markdown files to the local filesystem using the --persist flag.
Sanitization: Input sanitization for the content being written cannot be fully verified as the logic in design_system.py and core.py is missing from the provided files.
[Command Execution] (LOW): The skill utilizes a Python script to manage design systems, which includes logic for writing files to the disk based on user-controlled input.
Path Traversal Risk: In scripts/search.py, the project_slug used for directory creation is derived from the --project-name argument using replace(' ', '-'). This does not sanitize for directory traversal characters like .. or /, which could allow an attacker to influence where the agent writes files on the system.
Evidence: project_slug = args.project_name.lower().replace(' ', '-') if args.project_name else 'default' (Line 100).

ui-ux-pro-max