The Agent Skills Directory

[DYNAMIC_EXECUTION]: The utility script scripts/_extract.js uses the eval() function to process text extracted from a user-supplied file path. This mechanism poses a risk of arbitrary code execution if the script is executed against a malicious or untrusted input file.\n- [COMMAND_EXECUTION]: The scripts/optimize.js script executes external binaries (codex and apiz CLIs) using execFileSync to facilitate image editing. The security of these operations depends on the integrity and permissions of the installed command-line tools.\n- [EXTERNAL_DOWNLOADS]: The skill downloads processed image assets from remote URLs in scripts/optimize.js using Node.js http and https modules to fetch results from AI generation tasks.\n- [INDIRECT_PROMPT_INJECTION]: The scripts/optimize.js script allows user-provided prompts to be passed to external image generation models via the --prompt argument, which could be used to manipulate the behavior of those remote AI services.\n
Ingestion points: The --prompt command-line argument in scripts/optimize.js.\n
Boundary markers: No boundary markers or ignore-embedded-instruction warnings are present in the script's handling of the prompt string.\n
Capability inventory: The script uses execFileSync for tool invocation and networking modules for external data retrieval.\n
Sanitization: The user-supplied prompt string is passed to external tools without validation or sanitization.

pindou-pattern