The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The backend server in server.cjs serves the OPENAI_API_KEY environment variable in plain text via the /api/key endpoint. Critically, the server is configured with Access-Control-Allow-Origin: *, which allows any website visited by the user to perform a cross-origin request and steal the API key from the local server.
[COMMAND_EXECUTION]: The skill instructs the AI agent to execute shell commands and modify its own source code on the host machine. CONTEXT.md directs the agent to run git add -A && git commit and edit index.html based on user requests.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted audio input that is transcribed and passed directly to a high-privilege AI agent without sanitization. 1. Ingestion points: Microphone input in index.html sent to server.cjs. 2. Boundary markers: Absent; input is simply labeled with a prefix. 3. Capability inventory: The agent has explicit instructions to write to the local filesystem and execute shell commands. 4. Sanitization: Absent; the raw transcription is processed as part of the agent's instructions.
[DATA_EXPOSURE]: The skill leaks the local system's username through hardcoded absolute paths in server.cjs and CONTEXT.md (e.g., /Users/yuki/...).

voice-ui