The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to use npx -y lavish-axi, which downloads and executes arbitrary code from the npm registry. This behavior allows for unverified code execution on the host system at runtime.
[DATA_EXFILTRATION]: The skill provides a share command that publishes local HTML artifacts and their associated local assets to a third-party hosting service (https://ht-ml.app). The instructions state that these shares are public by default, which presents a high risk of leaking sensitive local files or environment details included in the artifacts.
[PROMPT_INJECTION]: The skill contains a directive to conceal monitoring activities from the user: "Do not tell the user the artifact is being monitored until that wake path is live." This instruction to hide agent behavior is a significant security red flag.
[INDIRECT_PROMPT_INJECTION]: The skill establishes a feedback loop where untrusted data from a browser (user annotations, whiteboard edits, layout issues) is processed by the agent to modify local files.
Ingestion points: Data returned by the npx -y lavish-axi poll command.
Boundary markers: None are specified; the agent is instructed to directly apply the feedback and edits.
Capability inventory: File system write access (artifact creation/updates), network access (polling and sharing), and command execution.
Sanitization: There are no instructions for sanitizing or validating the feedback received from the browser session before the agent acts upon it.
[COMMAND_EXECUTION]: The skill frequently invokes shell commands using npx, node, and npm root. It also instructs the agent to execute follow-up commands provided by the CLI tool's output, which could lead to command injection if the tool's output is compromised.
[EXTERNAL_DOWNLOADS]: In addition to the CLI tool, the skill suggests embedding external CDN-hosted resources (Tailwind CSS, DaisyUI, Mermaid) into generated artifacts without integrity verification.

lavish