The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use system commands (open on macOS or xdg-open on Linux) to open generated HTML files. While this is the intended functionality for displaying visuals, it involves executing shell commands with parameters derived from the generated file path.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from conversations and source code to generate visualizations and HTML artifacts, creating a surface for injection attacks.
Ingestion points: The skill explicitly instructs the agent to use conversation data and source code to establish names, paths, and data for the visuals (SKILL.md, HTML.md).
Boundary markers: There are no instructions to use delimiters or ignore instructions embedded within the processed data.
Capability inventory: The agent has the ability to write files to the workspace and execute shell commands to open them.
Sanitization: The instructions do not include requirements for sanitizing or escaping the data before it is included in the generated HTML/scripts.
[DYNAMIC_EXECUTION]: The skill generates HTML files that include styles and scripts at runtime and then triggers their execution by opening them in a browser. This allows for the execution of agent-generated code based on potentially malicious input.

show-me