The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes Python and Node.js scripts (e.g., gemini_batch_process.py and screenshot.js) using subprocess calls. These commands interpolate user-controlled variables such as campaign names, style keywords, and prompt descriptions directly into shell arguments, creating a surface for command injection.
[EXTERNAL_DOWNLOADS]: The workflow includes a research step where the agent navigates to pinterest.com to collect design references and screenshots. This introduces external, untrusted content into the agent's environment and subsequent processing steps.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its handling of external data and user input. Ingestion points: Untrusted data enters the context via Pinterest research results and user-supplied banner content (headlines, text). Boundary markers: No explicit delimiters or instructions are used to isolate or ignore malicious instructions that might be embedded in the design content or user inputs. Capability inventory: The agent can execute local scripts, perform file system operations (writes to the assets directory), and browse the web. Sanitization: There is no evidence of sanitization or validation of the input strings before they are used to generate prompts or script arguments.

banner