The Agent Skills Directory

[PROMPT_INJECTION]: Metadata Discrepancy (Category 7): The skill.meta.json manifest explicitly claims support for 'Custom canvas dimensions (64–8192px)' as a core feature. However, the SKILL.md instruction file explicitly states multiple times (e.g., Step 1) that 'Custom canvas dimensions are not supported' and instructs the agent to tell users that such requests are out of scope. This contradictory metadata is deceptive and may cause the agent to misjudge its capabilities or ignore safety/scope constraints.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface (Category 8): The skill ingests user-supplied 'briefs' and 'content density rules' which are then used to generate HTML for rendering.
Ingestion points: User-provided text describing dimensions and layout in SKILL.md (Step 4).
Boundary markers: The instructions do not specify any delimiters or warnings to ignore instructions embedded within the user data.
Capability inventory: The skill uses node to execute a screenshot tool, writes files to the local disk, and uses npx to publish data to a remote server.
Sanitization: There are no instructions provided for sanitizing or escaping user-provided input before it is interpolated into the generated HTML structure.
[COMMAND_EXECUTION]: Subprocess Execution: The skill requires the execution of multiple CLI tools, including npm, npx, and node. It specifically calls a local script goose-graphics/screenshot/screenshot.js to perform rendering tasks.
[EXTERNAL_DOWNLOADS]: Dependency Management: The skill workflow involves installing external software packages and browser binaries using npm install and npx playwright install chromium. While standard for the described task, this involves downloading and executing content from external registries.
[DATA_EXFILTRATION]: Data Export to Remote Hub: The skill uses npx gooseworks formats publish to transmit locally generated manifests and rendered PNG images to the gooseworks.ai platform. This constitutes the intended publication behavior but involves the transfer of generated assets to a remote service.

goose-graphics-create-format