The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to read sensitive credentials from the path ~/.build-host/credentials.json. These credentials are used to authenticate and perform network operations, including POST and GET requests, to the external domain build.host. This pattern of accessing local secrets and transmitting them to a non-whitelisted service constitutes a high-risk data exfiltration vector.
[COMMAND_EXECUTION]: The operating procedure mandates that the agent "run local checks" and "choose the smallest framework that fits." These instructions necessitate the execution of arbitrary shell commands and the potential installation of external software dependencies on the host machine, which could be leveraged to execute malicious code or compromise the system environment.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted user input to drive core functionalities.
Ingestion points: The agent ingests user-provided "briefs" to generate site content and deployment configurations as described in SKILL.md.
Boundary markers: The skill fails to define any delimiters or instructions that would prevent the agent from obeying malicious commands embedded within the user's brief.
Capability inventory: The agent has the capability to execute local shell commands (for environment checks) and perform network-based deployments (via the build.host API).
Sanitization: There are no specified mechanisms for escaping, validating, or filtering the content of the user brief before it is processed and deployed.

linktree