The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is instructed to read from and write to ~/.claude/memory/personal-asset-index.json to manage user identity and design preferences. This file contains sensitive personal data including real names, contact information, and local project paths. Accessing the agent's private memory directory represents a significant data exposure risk.
[COMMAND_EXECUTION]: Multiple scripts (render-video.js, add-music.sh, convert-formats.sh) execute shell commands such as ffmpeg, ffprobe, and awk using arguments derived from the agent's current task. While these are intended for media export, the execution of arbitrary command lines with potentially unvalidated inputs is a high-risk pattern.
[PROMPT_INJECTION]: The skill implements a 'Core Asset Protocol' (in SKILL.md) that involves downloading raw HTML and SVG files from the web via curl and WebSearch and processing them to extract brand assets. This process ingests untrusted data from external sources and interpolates it into the agent's context, creating an indirect prompt injection surface.
Ingestion points: Web content and brand assets downloaded via curl and WebSearch (specified in SKILL.md Step 2 and 3).
Boundary markers: Absent. The agent is not instructed to use delimiters or ignore instructions within the ingested data.
Capability inventory: The skill can execute shell commands (spawnSync), perform file system operations (Read/Write), and conduct network requests (curl).
Sanitization: Absent. Raw HTML and SVG content are processed directly.
[EXTERNAL_DOWNLOADS]: The skill fetches resources from external domains, including brand assets from arbitrary remote servers and design libraries from standard CDNs such as unpkg.com and fonts.googleapis.com.
[PROMPT_INJECTION]: The skill uses extremely authoritative instructions ('核心原则 #0', '优先级最高', '凌驾所有其他流程') and 'Checkpoints' to strictly control agent behavior and override default operational constraints.
[PROMPT_INJECTION]: There is a discrepancy between the stated author of the skill (jpoindexter) and the internal branding within the files, which refers to alchaincyf and the domain huasheng.ai. This mismatch in metadata can be deceptive regarding the actual origin and authorship of the skill.

huashu-design