The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/optimize-fonts.ts invokes shell commands using child_process.exec. Filenames retrieved from the file system are interpolated directly into the command strings without escaping or sanitization.\n
Evidence: The script calls await execAsync(woff2_compress ${input}) where input is a filename derived from fs.readdir.\n
Risk: This pattern creates a command injection vulnerability if the processed directory contains files with specially crafted names containing shell metacharacters.\n- [EXTERNAL_DOWNLOADS]: The skill documentation includes instructions to install various Node.js packages and system-level utilities for image and font processing.\n
Node.js dependencies: sharp, imagemin, imagemin-mozjpeg, imagemin-pngquant, and imagemin-svgo.\n
System dependencies: git-lfs, woff2, and sfnt2woff utilities.\n- [DYNAMIC_EXECUTION]: The font optimization process involves the dynamic assembly and execution of shell commands at runtime to handle file format conversions.

Asset Manager