The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides dbQuery and dbExec helpers allowing extensions to perform raw SQL operations on the host database. Although the documentation mentions automatic scoping, raw SQL access is a high-privilege function that could be abused if the agent generates malicious queries.
[COMMAND_EXECUTION]: Extensions can invoke any application-defined action via the appAction helper, providing a mechanism for the generated code to trigger server-side logic.
[REMOTE_CODE_EXECUTION]: The create-extension and update-extension actions allow the agent to generate and host arbitrary HTML, JavaScript, and Alpine.js code. This code is executed in the user's browser context within a sandboxed iframe.
[REMOTE_CODE_EXECUTION]: The contentFromAttachment feature allows the system to host user-pasted content verbatim as an extension, potentially allowing the execution of unvetted third-party code.
[DATA_EXFILTRATION]: The extensionFetch helper enables the exfiltration of data to external domains. It includes a server-side proxy that can inject sensitive secrets into request headers.
[PROMPT_INJECTION]: The extension framework creates a surface for indirect injection attacks. Extensions ingest data from external APIs and the database, which is then rendered using directives like x-html. This bypasses standard sanitization and could lead to Cross-Site Scripting (XSS) within the extension sandbox. * Ingestion points: references/api.md (extensionFetch, dbQuery). * Boundary markers: SKILL.md (Iframe sandbox). * Capability inventory: references/api.md (dbExec, appAction, extensionFetch, appFetch). * Sanitization: SKILL.md (Explicit documentation of x-html for rendering content).

extensions