The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/web-frames.mjs script facilitates arbitrary JavaScript execution within a browser context via page.evaluate() and dynamic module loading via import(), driven by user-supplied command-line arguments. This constitutes a medium risk as it allows execution of arbitrary logic based on script inputs.\n- [COMMAND_EXECUTION]: Several scripts in the skill (chart.py, compare.py, gif.sh, media-urls.sh) perform file system operations and invoke external tools such as ffmpeg, gh, and git for media generation and hosting.\n- [EXTERNAL_DOWNLOADS]: The skill documentation recommends the installation of external dependencies like playwright and vhs. Additionally, scripts/media-urls.sh uses curl to verify availability of hosted media on GitHub domains, which are recognized well-known services.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting repository content and PR descriptions to drive script-based visual generation. The arguments passed to these tools are derived from potentially untrusted data without explicit boundary markers or sanitization, though severity is limited by the developer-centric use case.

visual-pr