The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands that incorporate un-sanitized user input. Specifically, in Step 5, the user-supplied '' and '' are interpolated directly into shell commands like 'bun run' and 'sips'. This pattern allows for command injection if a user provides a malicious ID containing shell metacharacters (e.g., 'style-id; malicious_command').
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting user-defined metadata and applying it to sensitive operations without sanitization. * Ingestion points: User-provided name, ID, category, and prompt hints in SKILL.md (Step 1). * Boundary markers: None. The agent is not instructed to validate or escape these inputs. * Capability inventory: File writes to 'styles.json', 'README.md', 'plugin.json', and 'SKILL.md' (Steps 4, 7, 8); shell command execution via 'bun run' and 'sips' (Steps 5, 7). * Sanitization: None. User input is directly placed into filesystem paths, file content, and shell arguments.
[DYNAMIC_EXECUTION]: Step 7 requires the agent to execute a JavaScript snippet using 'bun -e'. This script processes the 'styles.json' file, which is populated with un-sanitized user input, and uses that data to generate and write the 'STYLES.md' file. This represents a risk where malicious data in the registry could influence the behavior of the generation script.

style-creator