The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/full-page-screenshot.mjs generates a temporary Python script (_stitch.py) to handle image stitching for large captures.\n
The implementation interpolates the outputFile variable directly into a Python string literal: out.save("${outputFile}").\n
Since outputFile is a user-controlled positional argument, a crafted path containing Python escape characters or command separators could allow arbitrary code execution within the Python environment.\n- [COMMAND_EXECUTION]: The script uses child_process.execSync to run the dynamically created Python script and other system tools.\n
It executes python3 with the generated script path.\n
It suggests running sips or file to verify the output file properties.\n- [EXTERNAL_DOWNLOADS]: The skill requires the third-party Python library Pillow for its stitching functionality.\n
Users are instructed to install this dependency manually via pip3 install Pillow.\n- [DATA_EXFILTRATION]: The script searches for sensitive browser configuration files to identify active debugging ports.\n
It attempts to read DevToolsActivePort from multiple platform-specific paths (e.g., Library/Application Support/Google/Chrome/ or .config/google-chrome/).\n
While this is a functional requirement for Chrome DevTools Protocol automation, it involves programmatic access to browser metadata.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and renders arbitrary web content via the --url parameter, creating an attack surface for indirect prompt injection.\n
Ingestion points: scripts/full-page-screenshot.mjs loads external URLs into a browser context.\n
Boundary markers: Absent.\n
Capability inventory: Includes shell command execution, file system access, and browser automation.\n
Sanitization: Absent; content is rendered as-is.

full-page-screenshot