The Agent Skills Directory

[COMMAND_EXECUTION]: The conversion logic in assets/html-to-pdf.js accepts a user-provided --executable-path argument and an environment variable PUPPETEER_EXECUTABLE_PATH. These inputs are passed directly to puppeteer.launch, which executes the specified binary. This could be abused to run arbitrary local programs. Furthermore, the browser is configured to launch with --no-sandbox and --disable-setuid-sandbox, which disables important security isolation features.
[DATA_EXFILTRATION]: The skill can render local files into PDFs by resolving paths provided as input and loading them via the file:// protocol in the browser. This provides a mechanism for an agent or attacker to access and export sensitive local files, such as SSH keys or configuration files, into a rendered document.
[METADATA_POISONING]: The skill includes a file named html-to-pdf_audit_result_v2.json which contains a comprehensive, yet entirely fabricated, security audit report. This document includes fake safety scores, 'PASS' ratings for security gates, and claims of manual verification. This is a deceptive technique intended to manipulate trust and misrepresent the skill's safety profile. Additionally, there is a path mismatch between the code provided in assets/ and the entry points defined in package.json (which point to scripts/), suggesting inconsistencies in the skill's packaging.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted HTML and URL content without sanitization, creating an attack surface where embedded instructions could influence agent behavior.
Ingestion points: Positional input argument in assets/html-to-pdf.js (CLI, stdin, or URL).
Boundary markers: None present to delimit or isolate external content.
Capability inventory: Subprocess execution (puppeteer.launch), network access (page.goto), and file system writes (page.pdf).
Sanitization: No filtering or sanitization of the HTML input is performed before rendering.

html-to-pdf