The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill's setup instructions direct the agent or user to utilize sudo apt install and sudo snap install for tools like cowsay, boxes, toilet, and ascii-image-converter, granting elevated permissions during installation.
[COMMAND_EXECUTION]: The skill relies on shell command execution for its primary functions, including curl for external data retrieval, pip and go for package installation, and direct execution of local binaries.
[EXTERNAL_DOWNLOADS]: The skill downloads content and installs tools from several non-trusted external sources, including asciified.thelicato.io, ascii.co.uk, qrenco.de, wttr.in, and the GitHub repository TheZoraiz/ascii-image-converter.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill fetches data from ascii.co.uk, asciified.thelicato.io, and other third-party APIs (SKILL.md).
Boundary markers: No delimiters or safety instructions are used when processing the downloaded text before displaying it.
Capability inventory: The skill environment supports shell execution (curl, pip, sudo apt), file system writes (/tmp/ascii_art.html), and Python script execution (SKILL.md).
Sanitization: Sanitization is limited to basic HTML tag removal using regex, which is insufficient to prevent sophisticated prompt injection or malicious terminal escape sequences from influencing the agent.

ascii-art