The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary rendering workflow in SKILL.md and several JavaScript utility files (scripts/card.js, scripts/gallery_render.js, scripts/batch_render_covers.js) utilize child_process.execSync to execute shell commands.
Evidence: scripts/card.js constructs and executes commands using variable paths, such as node "${CAPTURE_SCRIPT}" "${out.htmlPath}" "${pngPath}" ....
[REMOTE_CODE_EXECUTION]: The skill uses Playwright to open and render HTML files generated from user input. This poses a security risk if the input text contains malicious JavaScript, as the headless browser will execute the script during the screenshot capture process.
Evidence: assets/capture.js and assets/capture4k.js use page.goto(fileUrl, { waitUntil: 'networkidle' }) to render local HTML files that incorporate untrusted strings.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it processes untrusted data from external URLs and user text without sufficient isolation.
Ingestion points: SKILL.md (Step 1) specifies that content can be ingested via WebFetch from URLs or pasted text.
Boundary markers: The instructions do not define boundary markers (e.g., delimiters) to separate instructions from untrusted data, nor do they advise the agent to ignore instructions embedded within the processed content.
Capability inventory: The skill has access to shell command execution (execSync in card.js), file system write access for temporary HTML files, and network access via the Playwright browser context.
Sanitization: While scripts/lib/escape.js provides basic HTML entity escaping for structured modes, the "AI-only" modes (infographic, comic, sketchnote) rely on the agent to construct raw HTML and CSS, which lacks guaranteed sanitization of user-supplied text.
[EXTERNAL_DOWNLOADS]: The skill's HTML templates and scripts fetch assets from well-known and trusted external services.
Evidence: Templates in assets/*.html load fonts from fonts.googleapis.com and fonts.gstatic.com. scripts/gallery_render.js utilizes picsum.photos for placeholder images.

card-skill