The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing external binaries and scripts. The scripts/build_sample.mjs script uses execFileSync to invoke the cawplan CLI tool. Additionally, the workflow requires the agent to run node and python3 -m http.server to execute local logic and serve the web UI.
[DATA_EXFILTRATION]: The workflow starts an unauthenticated local web server (python3 -m http.server 8765) to host the label editor. This server hosts internal logs at assets/samples/latest.json. These logs, as shown in the provided samples, contain sensitive internal information such as project names, code paths, and discussions regarding security vulnerabilities and API keys. This configuration allows any user or process on the local machine (and potentially the local network) to access the sensitive data without authentication.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted human-input logs, which creates a vulnerability surface for indirect prompt injection.
Ingestion points: Data is fetched via the cawplan CLI and processed in scripts/build_sample.mjs before being displayed in the label-editor.html.
Boundary markers: The instructions lack explicit boundary markers or instructions to the agent to disregard commands embedded within the logs being processed.
Capability inventory: The skill has the ability to write files (writeFileSync), execute shell commands (Bash tool), and serve content over the network.
Sanitization: While scripts/classify_context.mjs performs text normalization (removing emojis and redaction marks) and the HTML editor uses escapeHtml for display, these do not prevent the agent from potentially interpreting instructions within the raw data during the processing phase.

cawplan-internal-qa-coding-humaninputs-sample