The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains multiple instructions (in references/mode-product-main.md, references/mode-banner.md, and references/mode-batch.md) that direct the agent to execute shell commands with user-controlled variables. Specifically, strings such as product names, activity descriptions, and generated prompts are interpolated directly into the arguments (e.g., --prompt, --title, --subtitle) of local Python scripts like nano_banana2.py and render_template.py. A malicious user could provide input containing shell metacharacters (e.g., ;, &&, |, or backticks) to execute arbitrary code on the host environment.
[DATA_EXFILTRATION]: The command injection vulnerability identified above could be used to exfiltrate sensitive system data. An attacker could craft an input that, when executed, reads local files (such as .env or SSH keys) and transmits their contents to an external server via common network utilities like curl or wget.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its automated web analysis feature in references/mode-reference-gen.md. It uses a browser tool to screenshot external URLs and then analyzes the visual content to generate a "Design Brief" and AI image prompts. Maliciously crafted text on a target website could be interpreted as instructions by the vision or analysis model, leading to poisoned design outputs or the execution of unintended actions.
Ingestion points: User-supplied URLs are opened and screenshotted using the take_screenshot tool (SKILL.md, references/mode-reference-gen.md).
Boundary markers: None identified; the skill directly incorporates analyzed content into subsequent prompt construction.
Capability inventory: The skill has the ability to execute shell commands via subprocess calls to local scripts and write files to the /tmp directory.
Sanitization: There is no evidence of sanitization or validation of the user input before it is used to build shell command strings.

design-pipeline