The Agent Skills Directory

[COMMAND_EXECUTION]: The script pwa/react-pwa/scripts/generate-icons.ts constructs a Node.js script as a string and executes it using Deno.Command. The script interpolates user-provided file paths (from CLI arguments) directly into the string using single quotes (e.g., sharp('${inputPath}')). If a user or an automated process provides a file path containing a single quote followed by JavaScript code, it will be executed by the Node.js process.
[REMOTE_CODE_EXECUTION]: The vulnerability in generate-icons.ts allows for arbitrary JavaScript execution within the Node.js subprocess. This can be exploited to run system commands, exfiltrate data, or gain further access to the host environment where the AI agent is running the skill.

frontend