The Agent Skills Directory

Indirect Prompt Injection (LOW): The skill is susceptible to indirect prompt injection because it ingests untrusted data from project files to generate code.
Ingestion points: The skill reads ideas/[project]/project-brief.md and shared/docs/style-guide.md to provide context for UI generation.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the input files are defined in the execution flow.
Capability inventory: The agent has Read, Write, Edit, Glob, Grep, and Task tools, allowing it to modify the filesystem but not access the network.
Sanitization: There is no evidence of sanitization or filtering of the content read from input files before it is processed by the LLM.
Data Exposure & Exfiltration (SAFE): While the skill reads project documentation, it does not have access to network tools (like curl or wget) or credentials, making exfiltration of that data unlikely within the skill's defined scope.
Unverifiable Dependencies & Remote Code Execution (SAFE): The skill does not perform any package installation or remote script fetching. All operations are local file manipulations.

ui-design