The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's instructions for running the ad pipeline (node dist/cli.js ad '<the brief, verbatim>') describe a command construction pattern vulnerable to injection. Because the agent is instructed to place untrusted user input verbatim into a single-quoted shell command string, a brief containing a single quote could terminate the argument and allow the execution of arbitrary shell commands on the host machine.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data in the form of a creative brief which is then processed by a multi-stage pipeline of AI agents (creative, script, compliance). There are no instructions for the agent to sanitize this input or apply boundary markers, creating a surface where malicious instructions embedded in the brief could influence the behavior of downstream agents.
Ingestion points: User creative brief passed through the Workflow steps in SKILL.md.
Boundary markers: The instructions use single quotes for shell interpolation but do not provide delimiters or warnings to downstream agents regarding the untrusted nature of the brief.
Capability inventory: Execution of Node.js CLI tools, shell scripts, filesystem writes to the projects directory, and local network requests to model service APIs.
Sanitization: The skill explicitly instructions the agent to never translate, summarize, or rephrase the brief, mandating it be passed verbatim without sanitization.

cinefoundry-ad-film