The Agent Skills Directory

[COMMAND_EXECUTION]: The script api/browser/open-url.js is vulnerable to shell command injection. It uses child_process.exec to execute system commands (open, start, or xdg-open) and interpolates the url variable directly into the command string within double quotes without escaping shell metacharacters.
[COMMAND_EXECUTION]: In api/skill.js, the resolveHospital function accepts a URL directly from the context.resolvedHospital.url property if no match is found in the local database. This allows a maliciously crafted conversation context to supply a payload that triggers the command injection vulnerability in the URL-opening utility.
[EXTERNAL_DOWNLOADS]: The skill's download intent handler in api/skill.js provides direct links to download an Android application package (APK) from https://img.beautsgo.com/3.6.apk. While this is a vendor-owned resource, providing executable binaries via natural language skills carries inherent security risks for end users.
[COMMAND_EXECUTION]: The browser automation scripts api/browser/consult.js and api/browser/fill-form.js launch Chromium with the --no-sandbox flag, which reduces the security isolation provided by the browser process.

booking-skill