The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external files (e.g., outreach drafts) or terminal history and interpolates it into HTML templates without clear isolation.
Ingestion points: The skill reads data from local files in the _private/ directory and captures recent terminal output.
Boundary markers: There are no explicit instructions to use delimiters or boundary markers to prevent the agent from interpreting embedded instructions within the ingested data.
Capability inventory: The skill writes to the local file system (_private/views/) and executes shell commands (open) to launch the browser.
Sanitization: The instructions do not mandate escaping or sanitizing content before it is inserted into the HTML {content} placeholder, which may allow cross-site scripting (XSS) if the source data contains malicious HTML or JavaScript.
[DYNAMIC_EXECUTION]: The skill dynamically generates HTML and JavaScript files at runtime. While it uses predefined templates, the inclusion of unsanitized external data into an executable browser context poses a risk of arbitrary code execution within the user's browser.
[COMMAND_EXECUTION]: The skill uses the open command to launch the default web browser to view generated files. While this is the primary functionality of the skill, it involves direct interaction with the host's command execution environment.
[METADATA_POISONING]: The description field in plugin.json is truncated, and there is a slight inconsistency between the primary description (claiming "unstyled semantic HTML only") and the provided base template which includes CSS and JavaScript functionality.

quick-view