The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill clones remote Git repositories from GitHub using user-provided arguments ($REPO) in the workspace resolution phase. While it uses official GitHub domains, the content of these repositories is untrusted.
[INDIRECT_PROMPT_INJECTION]: The skill processes YAML configuration files (.flowchad/config.yml) and flow definitions (.flowchad/flows/*.yml) from the cloned untrusted repositories to drive its browser automation and deployment logic.
Ingestion points: SKILL.md performs a git clone of the user-supplied $REPO variable; stages/02-load-flows/CONTEXT.md reads and parses YAML files from the resulting checkout.
Boundary markers: The skill lacks explicit boundary markers or 'ignore' instructions when passing content from the untrusted repository into the agent's reasoning process for browser actions and expectations.
Capability inventory: The skill possesses extensive capabilities including shell execution (Bash), sub-agent spawning (Task), browser automation (Playwright, Navvi), and cloud deployment (Vercel).
Sanitization: While scripts/validate_contract.py performs basic checks on URL schemes and repository identity, it does not sanitize the natural language 'expect' strings or action parameters within the flow definitions against adversarial content.
[REMOTE_CODE_EXECUTION]: The skill uses npx to execute the Vercel CLI (npx vercel deploy) and Playwright, which can involve downloading and running external packages at runtime.
[COMMAND_EXECUTION]: The bash scripts in SKILL.md and stage contexts construct shell commands using variables derived from user input ($REPO, $PR_NUMBER, $FLOW_NAME). Although variables are generally quoted, the complexity of the shell operations increases the risk of command injection if the environment variables are manipulated.
[DATA_EXFILTRATION]: The skill handles sensitive environment variables such as VERCEL_TOKEN and PYLOT_DISPATCH_TOKEN. A malicious repository could potentially define flow steps or evidence backends designed to leak these credentials to an external server.

flowchad-runner