The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a CLI wrapper scripts/generate.js (compiled from scripts/generate.ts) meant to be executed via bun. While the primary intent is generating test data, it facilitates the execution of local scripts.
[DYNAMIC_EXECUTION]: In scripts/generate.ts, the skill uses import() with a dynamic URL constructed from a user-supplied module path: import(pathToFileURL(resolve(module)).href). This behavior allows the execution of arbitrary JavaScript/TypeScript code contained in the targeted file. While this is the core functionality of the skill (loading a schema definition), it presents a risk if an attacker can influence the module argument to point to a malicious file, leading to arbitrary code execution within the agent's context.

effect-arbitrary