The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The screenshots/SKILL.md file instructs the agent to ask users for their plaintext email and password if the application requires authentication. It then generates a Node.js script (screenshot-script.mjs) that hardcodes these credentials in plain text to automate the login process. This practice exposes sensitive user credentials in the file system and potentially command history.
[COMMAND_EXECUTION]: The design-consultation/SKILL.md file contains an extensive 'Preamble' section that executes multiple shell commands and local binaries from ~/.claude/skills/gstack/bin/. These binaries (e.g., gstack-update-check, gstack-config, gstack-telemetry-log) are not provided within the skill package and their integrity cannot be verified during static analysis.
[EXTERNAL_DOWNLOADS]: The design-consultation/SKILL.md file contains a command to download and execute a script directly via curl -fsSL https://bun.sh/install | bash. While bun.sh is a well-known service, piped execution of remote scripts is a high-risk pattern.
[REMOTE_CODE_EXECUTION]: The web-artifacts-builder/scripts/init-artifact.sh and bundle-artifact.sh scripts perform npm install -g pnpm and pnpm add -D ... which execute third-party code from the public npm registry. While common in development, these are unversioned installations performed at runtime.
[PROMPT_INJECTION]: The screenshots/SKILL.md and design-consultation/SKILL.md modules read local project files such as README.md, CHANGELOG.md, and routing configurations to automate their tasks. This creates an indirect prompt injection surface where a malicious project file could influence agent behavior, although the instructions currently lack explicit sanitization or boundary markers.

ccc-design