The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple external tools including Playwright (via Node.js), ffmpeg, curl, and asciinema. The capture.sh script wraps these commands and passes user-supplied arguments like URLs, shell commands, and file paths to them.
[INDIRECT_PROMPT_INJECTION]: The capture-web.mjs script dynamically imports and executes a JavaScript module provided via the --steps argument. If an attacker can influence the content of the file passed to --steps (e.g., by creating a malicious file in the repository), they can achieve arbitrary code execution in the context of the agent.
Ingestion points: scripts/capture.sh via the --steps flag which is passed to assets/capture-web.mjs.
Boundary markers: None. The script uses import() to load and execute the provided file directly.
Capability inventory: The skill has access to node, curl, ffmpeg, and bash execution.
Sanitization: No validation is performed on the content of the --steps file before execution.
[DATA_EXFILTRATION]: The skill is designed to capture screenshots, video, and HTTP logs. While it includes a finalize.sh --scrub option using gitleaks, this only scans text artifacts. Screenshots and videos can leak sensitive information (API keys, PII, session tokens) displayed in the UI during recording, which are then stored in the .evidence folder.

demo-evidence