The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/capture-screenshots.js dynamically generates a JavaScript file (.capture-tmp.mjs) containing Playwright automation logic and executes it using execSync. Generating and executing code at runtime is a high-risk pattern that can lead to code injection.
[COMMAND_EXECUTION]: The script scripts/run-review-task.js uses spawnSync to execute arbitrary commands based on user-provided runner names and arguments. This provides a vector for command execution within the agent's environment.
[PROMPT_INJECTION]: The skill implements scripts/detect-unassigned-tasks.js, which scans the local codebase for comments (TODO, FIXME, HACK, XXX). These comments originate from potentially untrusted files and are interpolated into reports without sanitization, creating a surface for indirect prompt injection.
[EXTERNAL_DOWNLOADS]: scripts/capture-screenshots.js requires the installation of external packages like playwright and the chromium browser. While these are provided by well-known services and organizations, the skill's infrastructure facilitates the runtime download and execution of these external binaries.

task-specification-creator