The Agent Skills Directory

[DATA_EXFILTRATION]: The template preview utility in references/email-testing.md is vulnerable to path traversal attacks. The code takes the templateName directly from req.query and uses it to construct a file path via path.join() without any validation or sanitization. This pattern allows an attacker to access arbitrary files on the local filesystem outside of the intended templates directory.
[COMMAND_EXECUTION]: The skill includes patterns for automated email rendering and client testing using puppeteer (headless browser) in references/email-testing.md. While standard for this use case, headless browsers are high-capability tools that require strict sandboxing to prevent Server-Side Request Forgery (SSRF) or unauthorized local file access when processing dynamic content.
[PROMPT_INJECTION]: The skill facilitates indirect prompt injection by ingesting untrusted data and interpolating it into templates.
Ingestion points: Email variables (e.g., {{name}}) in SKILL.md and webhook payloads (e.g., SendGrid/SES events) in references/email-analytics.md and references/email-testing.md.
Boundary markers: The provided code snippets do not implement boundary markers or instructions to ignore embedded commands in variables.
Capability inventory: The skill interacts with external email APIs (references/delivery-setup.md), accesses the local filesystem for templates (references/email-testing.md), and executes code via a headless browser (references/email-testing.md).
Sanitization: Although the Security Considerations section in SKILL.md advises escaping raw user input, the provided implementation snippets do not demonstrate these safeguards explicitly.
[DYNAMIC_EXECUTION]: The template engine pattern in SKILL.md and references/mjml-templates.md uses Handlebars.compile and mjml2html to process MJML strings that include user-supplied variables at runtime. This dynamic rendering is a core feature but represents an execution surface for malformed templates.

backend-transactional-email