The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/codex-audit-loop.sh and scripts/genimage.sh interpolate user-controlled variables ($BRIEF and $PROMPT) directly into shell command strings without sanitization. This creates a high risk of command injection if the input contains shell metacharacters like backticks or command substitution syntax.
[REMOTE_CODE_EXECUTION]: The scripts/audit.mjs script implements a dynamic loading mechanism that searches for the playwright library in various global and local directories and executes it using import(). Loading code from unverified or user-writable paths can lead to arbitrary code execution if a malicious package is present in the search path.
[DATA_EXFILTRATION]: The audit utility accesses and reads local files, such as index.html, and performs environmental discovery by executing npm root -g to identify global configuration paths.
[EXTERNAL_DOWNLOADS]: The skill references font assets from Google Fonts (fonts.googleapis.com) to support its UI design functionality. These references target a well-known service and are consistent with the skill's stated purpose.
[COMMAND_EXECUTION]: The skill's QA process (defined in references/checklist.md) is designed to persist information across different projects and sessions by writing data to a hidden file (~/.design-log.json) in the user's home directory.

goddesign