The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/start-server.sh is vulnerable to command injection. The variable $PORT is extracted from the user-provided --socket argument and interpolated directly into a shell command (docker run --rm -p "$PORT:$PORT" ...) without validation. This allows an attacker to inject additional Docker flags or shell operators.
[COMMAND_EXECUTION]: The reference documentation in references/editor-configuration.md for the Helix editor recommends mounting the host's root directory (/root) into the Docker container using the volume flag -v "/root:/workspace". This grants the container (and any code running within it) full access to the host's filesystem.
[REMOTE_CODE_EXECUTION]: The skill uses npx --yes yaml-language-server to download and execute the language server package from the npm registry at runtime, which introduces a dependency on external code execution.
[EXTERNAL_DOWNLOADS]: The skill downloads the node:lts-alpine image from Docker Hub and fetches configuration schemas from json.schemastore.org.
[PROMPT_INJECTION]: The skill ingests untrusted YAML data from the workspace into the agent's context via the language server's diagnostics and completions without boundary markers or sanitization, creating a surface for indirect prompt injection.

yaml-lsp