The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to fetch the lavish-axi package from the npm registry without version pinning at runtime.
[REMOTE_CODE_EXECUTION]: The agent is instructed to execute the lavish-axi package via npx. Because the version is not pinned (e.g., using @version), this creates a supply-chain risk where a compromised package could execute arbitrary code in the environment.
[COMMAND_EXECUTION]: The workflow relies on multiple shell commands to manage HTML artifacts and long-poll for user feedback via the lavish-axi CLI.
[DATA_EXFILTRATION]: The npx lavish-axi share command uploads local artifacts to the third-party domain ht-ml.app. The instructions explicitly state that these artifacts are public by default, which could lead to sensitive project data or plans being exposed to unauthorized parties.
[PROMPT_INJECTION]: The skill includes a directive to conceal the polling activity from the user ('Do not tell the user the artifact is being monitored until that wake path is live'), which matches patterns for concealing agent actions and reducing transparency.
[CREDENTIALS_UNSAFE]: The share command accepts sensitive information such as passwords and tokens via command-line arguments (--password and --token), which is an insecure practice as secrets can be recorded in shell history or process listings.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect injection by reading user feedback from the lavish-axi poll command (Ingestion Point in SKILL.md) without specified boundary markers or instructions to ignore embedded commands. The agent maintains the capability to modify the filesystem and execute further commands based on this untrusted input.

lavish