The Agent Skills Directory

[COMMAND_EXECUTION]: The 'feedback-bridge.mjs' utility script, used for transmitting user feedback from the browser to the agent, contains a critical security flaw. It starts a local server on port 8930 with permissive Cross-Origin Resource Sharing (CORS) headers ('Access-Control-Allow-Origin: *'). The script is also vulnerable to path traversal because it uses unsanitized file names from the JSON request ('screenshotFile') to construct file paths for writing ('fs.writeFileSync'). This combination allows any website visited by the user while the bridge is running to potentially perform a CSRF attack and overwrite sensitive files outside the intended directory.
[REMOTE_CODE_EXECUTION]: Instructions in 'SKILL.md' and related workflow files direct the agent to perform a 'git clone' of an unverified repository ('https://github.com/nextlevelbuilder/ui-ux-pro-max-skill') into the '/tmp' directory. This process allows for the execution of unverified code from an organization that is not recognized as a trusted vendor, bypassing standard security practices for dependency management.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a broad attack surface for indirect prompt injection. It is designed to ingest data from external JSON files ('/tmp/slide-maker-edit/edit-feedback.json') containing feedback on generated slides. The skill environment includes powerful capabilities such as arbitrary shell command execution and browser automation via Playwright. The lack of explicit sanitization or instruction-isolating boundary markers when processing this untrusted feedback increases the risk that an attacker could embed malicious instructions in the feedback data to hijack the agent's actions.

slide-maker