The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on a local CLI tool named visual-artifact to perform actions such as creating, validating, and serving artifacts. It also instructs the agent to run various shell commands (e.g., fd, rg, git, ast-grep) to extract information from the local filesystem.
[EXTERNAL_DOWNLOADS]: The bootstrap command is used to "Build renderer and CLI, then install runtime files." This process involves fetching external resources and dependencies required for the skill's runtime environment.
[DATA_EXFILTRATION]: The skill includes a --publish feature that uploads artifact data to Cloudflare R2 buckets. While this is an intended feature for sharing artifacts, it constitutes a pathway for sending local project data to an external service. This requires sensitive Cloudflare R2 credentials (Access Key ID and Secret Access Key) which are managed via environment variables or .env files.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. The workflow requires the agent to read and analyze source code, documentation, and git logs from a target repository to generate reports. A malicious project could contain files with embedded instructions designed to hijack the agent's logic, bypass safety constraints, or influence the content of the generated artifacts during the "deterministic extraction" and "analysis" phases.
Ingestion points: Local project files and metadata read using tools like rg and ast-grep (referenced in deterministic-extraction.md).
Boundary markers: The instructions do not specify the use of clear delimiters or instructions for the agent to ignore potentially malicious content within the analyzed files.
Capability inventory: The skill possesses command execution (visual-artifact), filesystem read/write access, and network communication capabilities (Cloudflare publishing).
Sanitization: While the CLI performs schema validation on the final JSON spec, there is no evidence of sanitization or filtering for the natural language content extracted from untrusted source files before it is processed by the LLM.

visual-artifact