The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for the agent to use the Bash tool to run a local Node.js script (generate-palette.mjs) for color palette generation.- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (specifically command injection) because it takes user-supplied parameters and places them directly into a shell command template without instructing the agent to perform sanitization.
Ingestion points: User-provided colors, character styles, and harmony settings for the generate color action (SKILL.md).
Boundary markers: There are no boundary markers or instructions to treat the user input as data rather than potential code or commands.
Capability inventory: The skill utilizes Bash, Read, Write, and Edit tools to interact with the project filesystem and execute code.
Sanitization: The skill lacks instructions or validation steps to sanitize or escape user input before it is interpolated into the shell command node <styleseed-root>/engine/color/generate-palette.mjs --key-color "$USER_COLOR".

ss-tokens