The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local TypeScript CLI and a shell script for rendering and publishing content.
Evidence: The skill instructs the agent to run npx tsx plugins/now/src/cli.ts for rendering and bash ~/.claude/skills/here-now/scripts/publish.sh for publishing.
[COMMAND_EXECUTION]: Potential for command injection exists where user-controlled variables are interpolated directly into shell command strings.
Evidence: Variables such as {topic}, {slug}, and {path} are embedded into bash and npx command lines. Without proper sanitization, malicious input could lead to arbitrary command execution.
[EXTERNAL_DOWNLOADS]: The use of npx may lead to the dynamic download and execution of packages from the NPM registry at runtime.
Evidence: Rendering is performed using npx tsx, which fetches the tsx package from the public registry if it is not already cached.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface by processing untrusted user data to generate HTML content.
Ingestion points: User-provided topic strings and the generated RenderSpec JSON data in SKILL.md.
Boundary markers: Absent. No delimiters or "ignore instructions" warnings are provided to separate the agent's logic from potentially malicious embedded content.
Capability inventory: The skill has access to Bash (for CLI operations) and Write (for file creation).
Sanitization: Absent. The inclusion of a custom-html element type allows for the generation of raw HTML and JavaScript, posing an XSS (Cross-Site Scripting) risk in the final rendered dashboard.

now