The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions require the installation of a global NPM package vibedgames (npm install -g vibedgames) to provide the vg CLI. This package is an external dependency from a source not recognized in the trusted vendor list.
[DYNAMIC_EXECUTION]: The skill implements a discovery mechanism to locate other skills (pixel-snapper and animated-spritesheets) by searching through multiple local directory patterns (e.g., .agents/skills, .claude/skills, ~/.agents/skills). It then executes Node.js scripts (image-util.mjs, pack-spritesheet.mjs) from these resolved paths. This behavior is risky as it could lead to the execution of malicious code if a deceptive skill is placed in one of the searched directories.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input to describe characters and effects, which is then interpolated directly into prompt strings for generative models.
Ingestion points: <character_desc> in SKILL.md (Recipes 1, 4) and <effect_desc> in references/fx-boards.md (Recipe 6).
Boundary markers: Absent; user input is appended to instructions without delimiters or "ignore" warnings.
Capability inventory: The skill utilizes remote API generation via the vg CLI and local script execution via node and ffmpeg for image processing.
Sanitization: Absent; no escaping or validation is performed on the user-provided strings before they are used in command-line arguments or prompts.
[COMMAND_EXECUTION]: Although the skill provides "Execution rules" intended to limit shell complexity (e.g., forbidding pipes and redirects), the provided recipes for animated FX (Recipe 5) utilize subshells for variable assignment (REQ=$(...), VIDEO_URL=$(...)) and bash loops for batch processing. These patterns increase the attack surface for command injection if the agent does not strictly sanitize the environment variables or file paths derived from user input.

pixel-art