The Agent Skills Directory

[COMMAND_EXECUTION]: The skill workflow constructs shell commands by interpolating user-provided text descriptions and reference paths directly into CLI arguments. This pattern is vulnerable to command injection; if the input contains shell metacharacters (e.g., semicolons, backticks, or pipes), an attacker could execute arbitrary commands on the host system.
[REMOTE_CODE_EXECUTION]: The skill is designed to automatically install and configure the listenhub binary if it is not detected during the authentication check. This involves downloading and executing external code from a remote source at runtime, which presents a significant supply chain risk and bypasses manual security review of the tool.
[DATA_EXFILTRATION]: The skill allows users to provide local file paths as 'reference images' for style guidance. These paths are passed to the CLI tool's --reference flag. A malicious user could provide paths to sensitive files (such as ~/.ssh/id_rsa or .env files), potentially exposing their contents to the CLI tool or the associated backend service.
[INDIRECT_PROMPT_INJECTION]: The skill serves as an attack surface for indirect prompt injection due to its handling of external data.
Ingestion points: User-provided image descriptions in Step 1 and reference URLs or file paths in Step 4.
Boundary markers: None. The input is placed directly into the command string without delimiters or boundary enforcement.
Capability inventory: The skill has the capability to execute shell commands (listenhub create) and perform network downloads (listenhub download).
Sanitization: No evidence of shell escaping, input validation, or sanitization is present in the instruction flow.

image-gen