The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements 'Review pages' that collect user input via a local web form and save it to a state.json file. The agent is then instructed to read this file and 'Act on value'. This creates an indirect injection surface where malicious instructions could be embedded in form fields (labels or values) to influence subsequent agent behavior.
Ingestion points: The state.json file created in the temporary working directory by scripts/serve.py.
Boundary markers: None used when the agent reads the JSON content back into its context.
Capability inventory: The skill has capabilities to write files to the filesystem and execute shell commands (e.g., to start servers, open browsers, and take screenshots).
Sanitization: There is no explicit sanitization or validation of the text content retrieved from state.json before it is processed by the agent.
[COMMAND_EXECUTION]: The skill workflow involves executing several shell commands to manage a local server and verify HTML output.
Evidence: SKILL.md instructs the agent to run uv run <skill-dir>/scripts/serve.py start "$dir" and use browser binaries for headless screenshots (e.g., "<chrome-binary>" --headless ...). While these are standard developer actions, they involve executing shell commands with parameters derived from the local environment.

html-report