The Agent Skills Directory

[PROMPT_INJECTION]: The skill's metadata is deceptive regarding its origin. The metadata author is listed as 'build-host', while the actual author is 'erphq'. This mismatch could lead users to trust the skill with sensitive permissions based on a false identity.
[CREDENTIALS_UNSAFE]: The skill directs the agent to access sensitive authentication data located at ~/.build-host/credentials.json. Accessing credential stores is a high-risk operation, especially when the skill's authorship is inconsistent.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes project files without sufficient safeguards.
Ingestion points: The agent is instructed to read 'current UI and constraints' from the user's project directory during the styling process.
Boundary markers: The instructions do not specify any delimiters or warnings to the agent to ignore potential malicious instructions embedded within the files it analyzes.
Capability inventory: The agent has the ability to modify local files and make network requests (POST) to the build.host API, which could be exploited if an injection occurs.
Sanitization: There is no evidence of validation or sanitization of the code or content being analyzed by the agent before it is processed.

brutalist-theme