The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts capture-xhs-card.mjs, capture-xhs-carousel.mjs, and capture-template-previews.mjs implement dynamic module loading using paths provided via command-line arguments.
In capture-xhs-card.mjs and capture-xhs-carousel.mjs, the script imports a module name derived from the --playwright argument: await import(moduleName). If an attacker manipulates the command-line arguments, they could force the loading of a malicious local script.
In capture-screenshots.mjs, the path to the Chrome binary is accepted as an argument (--chrome) and subsequently used in spawn(chrome, args, ...). This allows for the execution of arbitrary binaries if the path is not strictly validated.
[INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection by ingesting untrusted user data into HTML templates that are processed by automated rendering scripts.
Ingestion points: User-provided topics and content are ingested in the Workflow section of SKILL.md to populate templates.
Capability inventory: The skill uses node to run scripts that spawn browsers (playwright, chrome) and write files to the workspace.
Boundary markers: The templates (e.g., assets/templates/xhs-cover-pixel-report/zh.html) do not use explicit delimiters or "ignore instructions" warnings for the sections where user content is interpolated.
Sanitization: There is no evidence of programmatic sanitization (e.g., HTML escaping) in the Node.js scripts; the skill relies on the LLM's instructions to "Rewrite" the topic.
[SAFE]: External resource links to Google Fonts (e.g., fonts.googleapis.com and fonts.gstatic.com) in sunrise/zh.html target a well-known service and are used for legitimate styling purposes.

lieflat-xhs-cover