The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill explicitly instructs users to execute a remote script from https://www.lazyweb.com/install.sh by piping it directly to bash. This pattern facilitates arbitrary code execution from an external source without integrity verification or content inspection.
[DATA_EXFILTRATION]: The skill accesses sensitive local data stored in ~/.lazyweb/libraries.json, which is described as containing session and connection information for external inspiration libraries. This data, along with base64-encoded local screenshots and structured research content, is transmitted to an external server (lazyweb.com) via the lazyweb_render_report tool for remote hosting.
[COMMAND_EXECUTION]: The skill contains multiple shell scripts designed to detect the local environment, verify the presence of executable binaries at computed paths (e.g., .lazyweb/repos/lazyweb-skill/browse/dist/browse), and perform project context analysis. These scripts execute local binaries and system commands to establish the skill's operational state.
[PROMPT_INJECTION]: The instructions utilize authoritative "CRITICAL" blocks and mandatory language to force the agent to follow specific output behaviors and report structures. This includes requirements to always produce hosted reports and avoid manual artifact creation, which can be used to override default agent behaviors or safety constraints.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its ingestion of untrusted data:
Ingestion points: The agent reads visionDescription fields from lazyweb_search results and processes external web content via the browse tool.
Boundary markers: No boundary markers or instructions to ignore embedded commands are present in the report generation phase.
Capability inventory: The agent has access to Bash, Write, and network-enabled tools (lazyweb_render_report) that can be influenced by the ingested data.
Sanitization: The skill explicitly states that all strings are handled as RAW and delegates all escaping and sanitization to the remote server, leaving the local agent exposed to potentially malicious payloads in the processed data.

lazyweb-lite-design-research