The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands using command substitution patterns, specifically grok -p "$(cat brief.md)". If the content of the brief.md file is influenced by untrusted external inputs and contains shell metacharacters (such as backticks, semicolons, or dollar-parens), it could lead to arbitrary command execution on the host machine during the invocation of generation tools.
[REMOTE_CODE_EXECUTION]: The skill utilizes npx to dynamically install and run packages such as hyperframes and create-video. Furthermore, it explicitly describes a workflow for installing third-party agent skills from arbitrary GitHub repositories using the command npx skills add <owner/repo>. This capability to pull and execute unverified code from the internet presents a significant supply chain and remote code execution risk.
[EXTERNAL_DOWNLOADS]: The studio.mjs helper script and the skill's instructions describe fetching resources from multiple external GitHub repositories, including prompt libraries from YouMind-OpenLab and skill definitions from heygen-com, remotion-dev, and greensock. This behavior pulls external, potentially unverified content into the agent's working context.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection. Ingestion points: It fetches thousands of prompts from the YouMind-OpenLab library and reads external skill text via the studio.mjs source command. Boundary markers: No delimiters or explicit instructions to ignore embedded commands are used when interpolating this untrusted data into Generation Briefs. Capability inventory: The skill can execute shell commands, install code via npx, and access authentication tokens. Sanitization: No sanitization or validation of the fetched external content is performed before it is used to construct the agent's instructions.
[CREDENTIALS_UNSAFE]: The helper script scripts/studio.mjs contains logic to programmatically detect and read the GITHUB_TOKEN or GH_TOKEN environment variables to authenticate GitHub API requests. While it includes internal checks intended to avoid printing the token, the programmatic access to these sensitive credentials increases the risk of exposure or exfiltration if the execution environment is compromised.

prompt-studio