The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses execFileSync and spawn to perform system-level operations, specifically modifying the Windows Registry via reg add to register Native Messaging hosts and utilizing chmod to manage directory and file permissions.\n- [COMMAND_EXECUTION]: Implements persistence mechanisms by writing manifest files into sensitive browser configuration directories (e.g., ~/Library/Application Support/Google/Chrome/NativeMessagingHosts/ and equivalent paths for Edge/Linux) and creating startup-related registry keys in HKCU.\n- [EXTERNAL_DOWNLOADS]: The skill downloads the @axhub/acp package from the NPM registry using the npx command. While this is a vendor-owned resource, it involves fetching and executing third-party code at runtime.\n- [REMOTE_CODE_EXECUTION]: The skill executes remote code fetched via npx and generates local shell and batch wrapper scripts (run_host.sh, run_host.bat) which are executed by the host system via the browser's Native Messaging API.\n- [PROMPT_INJECTION]: The skill processes untrusted external data from comments.json (Category 8). The ingestion point is the local comments.json file; while it performs schema validation, it lacks explicit prompt boundary markers. The skill possesses high-privilege capabilities including shell command execution and file writing, creating an indirect prompt injection surface. The evidence chain includes: 1) Ingestion point: comments.json; 2) Boundary markers: Absent; 3) Capability inventory: spawn, execFileSync, and file writes; 4) Sanitization: Schema and path validation.

axhub-commentary