The Agent Skills Directory

[SAFE]: The skill serves a legitimate purpose for numerology calculation and reporting. Analysis of the source code found no evidence of network exfiltration, credential theft, or unauthorized persistence mechanisms.
[COMMAND_EXECUTION]: The full report generation logic in generate-full-report.js utilizes child_process.execSync to invoke a local rendering script for infographics. This implementation includes sanitization for path traversal characters (.., /, \) in the user-supplied name field used in the command string.
[PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection as it interpolates user-supplied data into LLM prompts without explicit delimiters or boundary markers.
Ingestion points: User-provided name, birth date, and location in simple-fortune.js and enhanced-report-generator.js.
Boundary markers: None identified; data is directly embedded into markdown templates.
Capability inventory: Local file system write access (fs.writeFileSync) and subprocess execution (execSync).
Sanitization: Path traversal validation is performed on the 'name' field, though full shell escaping for all input fields is not implemented.
[SAFE]: External dependencies are limited to the reputable lunar-javascript library, which is appropriate for the skill's domain. The author ('konglong87') is consistent across all files and resources.

fortune-teller