The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from {slug}_images.json and {slug}_scenes.json to identify assets for embedding. These files represent an untrusted data ingestion surface.
Ingestion points: The skill reads JSON artifacts in SKILL.md (Stage 1) and passes them to the assets/build_html.py script (line 89).
Boundary markers: There are no markers or instructions provided to the agent or the build script to ignore potentially malicious instructions or paths embedded in these artifacts.
Capability inventory: The build script (assets/build_html.py) has the capability to read arbitrary files via open(path, 'rb') (line 68) and fetch data from external URLs using urllib.request.urlopen (line 62). It subsequently writes the collected data to a new HTML file.
Sanitization: The fetch_bytes function in the build script does not validate or sanitize the src paths provided in the input JSON. It allows absolute paths or relative paths using parent directory traversal (e.g., ../../), which can be exploited to read sensitive local files (e.g., SSH keys, configuration files). Additionally, it allows fetching from arbitrary URLs, creating a risk for Server-Side Request Forgery (SSRF).
[COMMAND_EXECUTION]: The skill instructions in SKILL.md (Stage 2) direct the agent to execute a shell command: python .claude/skills/story-html-publisher/assets/build_html.py {slug}. The {slug} parameter is directly interpolated into the shell command without quoting or sanitization, which creates a potential command injection vulnerability if the slug contains shell metacharacters like semicolons or backticks.

story-html-publisher