The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data (in 'Simpler', 'Visual', 'Joint', and 'Precise' modes) to generate artifacts like HTML files and Markdown documents. These files are subsequently opened or reviewed using shell commands, creating an attack surface where untrusted input could influence the generated content to execute malicious scripts (XSS) or mislead the agent.
Ingestion Points: User-provided text for re-phrasing, visualization, or rewriting, as well as previous assistant messages (SKILL.md).
Boundary Markers: Absent. There are no instructions for the agent to use delimiters or to treat the input as untrusted data.
Capability Inventory: File system write access to /tmp/ and the ability to execute shell commands via Bash(open ...) and file-review (SKILL.md).
Sanitization: Absent. The skill lacks instructions for escaping or sanitizing user-provided content before it is interpolated into HTML or Markdown artifacts.
[COMMAND_EXECUTION]: The skill explicitly directs the agent to execute shell commands such as Bash(open ...) for HTML visualization and file-review for Markdown documents written to the /tmp/ directory. While these tools are used for their intended visualization purposes, they represent a powerful capability triggered by user input.
[EXTERNAL_DOWNLOADS]: The skill references an external repository at github.com/luchasarie/bro-skill as a source for its logic. While this is presented as a documentation link, it points to an unverified third-party source.

comms