The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the image.filepath property from an external draft.json file directly in a shell command (exiftool -all= "<image.filepath>"). A malicious JSON file could provide a path containing shell metacharacters (e.g., backticks, semicolons) to execute unauthorized commands.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests untrusted data from draft.json and uses it to drive agent actions in a browser. * Ingestion points: The Read tool is used to load draft.json as described in SKILL.md. * Boundary markers: No delimiters or instructions are used to separate the tweet text from the agent's instructions. * Capability inventory: The skill has access to the Bash tool (for exiftool) and chrome-devtools for browser manipulation. * Sanitization: There is no validation or sanitization of the tweet text or image.filepath before they are used in high-capability tools.

x-post