The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx --yes kenkeep@latest to download and execute code from the npm registry at runtime. Because it uses the @latest tag rather than a pinned version or hash, the skill is vulnerable to supply-chain attacks where a malicious update to the package would be automatically executed on the host system.
[COMMAND_EXECUTION]: Multiple user-provided values (title, summary, tags, relates-to) are interpolated directly into a shell command string within double quotes: npx --yes kenkeep@latest node write <kind> <slug> --title "<title>" --summary "<summary>" --tags "<tags>" --relates-to "<relates-to>". If a user provides input containing shell metacharacters such as backticks, subshells $(...), or escapes the double quotes, they could achieve arbitrary command execution on the host system.
[PROMPT_INJECTION]: The skill processes user-provided data (body, title, summary, etc.) by passing it to a sub-agent for refinement. The instructions for the sub-agent do not include robust boundary markers or delimiters for the untrusted user content, creating an indirect prompt injection surface where the user's content could override the agent's logic.
Ingestion points: User inputs for node metadata and body markdown provided during the session.
Boundary markers: None explicitly defined in the sub-agent instructions; user content is provided as labeled inputs (body-draft=<body>).
Capability inventory: Subprocess execution via node and npx, and file system writes via node write and mkdir.
Sanitization: Slug derivation uses basic ASCII/hyphenation, but other metadata fields are passed as-is to shell arguments and agent prompts.

kk-add