The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/prose.ts uses child_process.execFile to execute a local CLI tool (defaulting to agy). This involves spawning subprocesses, which can be a vector for abuse if the binary behavior is misunderstood or manipulated.
[DYNAMIC_EXECUTION]: The script allows the path to the antigravity CLI to be overridden via the ANTIGRAVITY_CLI_PATH environment variable. Loading and executing binaries from paths defined by environment variables can be leveraged by an attacker to execute arbitrary code if the environment variables are manipulated.
[DATA_EXFILTRATION]: The script reads the .env.local file in the current working directory to load configuration and API keys. Accessing sensitive files in the working directory can lead to data exposure if the skill is run within a malicious or compromised project folder.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from standard input and command-line arguments, which are interpolated directly into the system prompt sent to LLM providers.
Ingestion points: The script reads from process.stdin (e.g., git diffs) and accepts a task argument from the command line.
Boundary markers: Uses simple Markdown headers like [작성 요청] and --- which do not provide robust separation between instructions and untrusted data.
Capability inventory: The skill has the capability to perform network requests to OpenRouter and Google AI Studio, and execute a local CLI tool.
Sanitization: No sanitization or validation of the user-provided input is implemented before it is processed by the model.

korean-prose