The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local shell scripts and the Node.js child_process module to manage a prototype preview server. These operations are restricted to specific directories and include checks for file ownership and the presence of symlinks to prevent unauthorized access or manipulation (e.g., in references/preview.md).
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection where user-provided annotations are ingested into the agent context through the light-webserver.js wait loop documented in references/annotation-loop.md. Evidence chain: (1) Ingestion points: references/annotation-loop.md via the JSON output of the wait command; (2) Boundary markers: Present in the same file as explicit instructions to treat inputs as data and avoid executing them as commands; (3) Capability inventory: File system writes and subprocess execution via the bash tool and the Node.js server scripts; (4) Sanitization: Relies on the agent following instructions to reason over batches before applying edits.
[SAFE]: Analysis of the skill's code and instructions reveals a security-conscious design. The local server uses UUID-based tokens for sensitive endpoints, and the containedRealPath function ensures that all file operations are confined within the intended prototype root, effectively preventing path traversal attacks.

ce-prototype