The Agent Skills Directory

[COMMAND_EXECUTION]: In scripts/live-copy-edit-agent.mjs, the skill executes external coding agents (codex and claude) via spawn. The codex invocation includes the --dangerously-bypass-approvals-and-sandbox flag, which is an explicit attempt to bypass environment security controls and approval requirements.
[COMMAND_EXECUTION]: The script scripts/detector/engines/browser/detect-url.mjs configures puppeteer with the --no-sandbox and --disable-setuid-sandbox flags if a CI environment variable is detected, which disables browser-level security restrictions.
[COMMAND_EXECUTION]: scripts/context-signals.mjs executes git commands and performs port probing on 127.0.0.1 to identify running development servers and repository status.
[EXTERNAL_DOWNLOADS]: scripts/context.mjs fetches version information from https://impeccable.style/api/version to check for skill updates.
[PROMPT_INJECTION]: The skill ingests untrusted data from local HTML/JSX files and external URLs in detect-html.mjs and detect-url.mjs. It lacks sanitization and boundary markers for this content. Combined with its ability to modify source code and execute commands (inventory in live-wrap.mjs, live-accept.mjs, and live-copy-edit-agent.mjs), this creates a vulnerability surface for indirect prompt injection.

impeccable