The Agent Skills Directory

[COMMAND_EXECUTION]: The verify_intake tool (scripts/verify_intake.py) executes npm run build using subprocess.run when node_modules are present in the project. This results in the execution of arbitrary scripts defined in the local package.json file. While intended for verification, this triggers execution of project-defined code.
[DATA_EXFILTRATION]: The ingest_mockups tool (scripts/ingest_mockups.py) accepts arbitrary filesystem paths via the --source and --source-dir arguments. It uses shutil.copy2 to copy files from these locations into the project directory, potentially exposing sensitive files on the user's system if they match the allowed image extensions (.png, .jpg, .jpeg, .webp, .svg).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input and incorporates it directly into structured documents (product.md, translation-*.md, mockup-brief.md) that are subsequently processed by other AI agent skills.
Ingestion points: Raw user prompts are loaded via load_intake.py and processed by write_translation.py and write_product.py.
Boundary markers: The skill does not use specific delimiters or instructions to prevent downstream agents from obeying commands embedded within the generated documentation.
Capability inventory: The skill suite has the ability to execute shell commands (npm run build) and perform filesystem copy operations.
Sanitization: There is no evidence of sanitization or escaping of the user-provided text before it is written to the project files.

heyeddi-intake