The Agent Skills Directory

[DATA_EXFILTRATION]: The skill exposes absolute file paths belonging to the author's local environment, disclosing the system's username and private directory structure. Accessing files in a user's home directory is a significant boundary violation.
SKILL.md instructs the agent to access a private rule file at /Users/charliedeist/Root/.claude/rules/writing-quality.md.
scripts/html_wrap_to_pdf.mjs hardcodes a Node.js module path: /Users/charliedeist/.npm-global/lib/node_modules/agent-browser/node_modules/playwright-core/index.mjs.
scripts/html_wrap_to_pdf.mjs hardcodes the browser executable path: /Applications/Google Chrome.app/Contents/MacOS/Google Chrome.
[COMMAND_EXECUTION]: The orchestration script scripts/pipeline.py utilizes subprocess.run to execute multiple internal Python scripts. While it uses list-based arguments to prevent simple shell injection, it establishes a capability for the skill to spawn and control new processes on the host system.
[DYNAMIC_EXECUTION]: The skill performs runtime manipulation of binary files and executes external software through computed or hardcoded absolute paths.
scripts/html_wrap_to_pdf.mjs performs direct byte-level patching of generated PDF files to modify /MediaBox dimensions using string replacement on the file buffer.
scripts/html_wrap_to_pdf.mjs launches and controls a headless Google Chrome instance via Playwright to render artboards.
scripts/html_wrap_to_pdf.mjs imports JavaScript modules from an absolute local filesystem path outside the skill's distribution folder.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied data which is interpolated into prompts for generative models and passed to composition scripts, creating a surface for injection attacks.
Ingestion points: User-provided book titles, author names, creative direction, and back cover copy are processed via scripts/pipeline.py, scripts/gen_openai.py, and HTML templates.
Capability inventory: Spawns sub-processes (subprocess.run), performs file system writes (Pillow), executes browser sessions (Playwright), and interfaces with external generative AI APIs (OpenAI).
Boundary markers: The skill suggests a "Safe-zone preamble" in prompts/leaf-cover.md to guide the image model's layout behavior, but lacks formal delimiters or warnings to prevent instruction override from the user-provided text content.
Sanitization: Inputs such as the back cover blurb are inserted into HTML templates and passed as CLI arguments without explicit sanitization or escaping mechanisms.
[EXTERNAL_DOWNLOADS]: The skill instructions describe procedures for fetching external content from well-known services.
SKILL.md fetches handoff bundles and design artifacts from Anthropic's design API (api.anthropic.com).

kdp-cover-wrap