The Agent Skills Directory

[DATA_EXFILTRATION]: Path Traversal vulnerability in render.js. The script resolves and reads local files specified in the src field of image blocks without validating that the paths are restricted to the expected assets directory. An attacker-controlled JSON input could use relative paths (e.g., ../../../../etc/passwd) to read sensitive files, which are then inlined as Base64 data URIs into the generated index.html file.
[COMMAND_EXECUTION]: The skill executes external commands and high-privilege applications. It uses playwright to launch a headless Chromium browser instance in screenshot.js to render HTML to PNG. It also involves CLI execution of Node.js scripts.
[PROMPT_INJECTION]: Indirect Prompt Injection surface. The skill processes JSON data (likely generated by an agent from potentially untrusted user input or external summaries) to drive its rendering engine.
Ingestion points: The render.js script reads and parses a JSON specification file provided via the --note CLI flag.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the processed JSON data blocks.
Capability inventory: The skill has the capability to read local files (fs.readFileSync in render.js), write local files (fs.writeFileSync in render.js and screenshot.js), and launch a web browser (chromium.launch in screenshot.js).
Sanitization: While text content is escaped for HTML, file paths in the image block's src field are not sanitized or validated against a safe directory root.

create-apple-notes-mockup