The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses execSync in lib/recorder.js to execute ffmpeg and ffprobe commands. The file paths passed to these commands are constructed using scenario names provided by the user, which are not sanitized. A maliciously crafted scenario name containing shell metacharacters could lead to arbitrary command execution on the host system.
[COMMAND_EXECUTION]: The Terminal Demo Flow in lib/terminal.js spawns a Pseudo-Terminal (PTY) using node-pty. While intended for CLI demos, the ability to specify the shell and working directory via user-defined scenarios poses a risk if not strictly controlled.
[CREDENTIALS_UNSAFE]: During the init flow described in SKILL.md, the agent is instructed to proactively scan the codebase for sensitive environment files such as .env and .env.local to discover API endpoints and service configurations. This practice exposes potential secrets to the agent's context.
[DYNAMIC_EXECUTION]: In lib/render-page.js, the skill uses eval() within a browser context (via Playwright's page.evaluate) to execute drawing commands for annotations. These annotations are generated from scenario descriptions, creating a path for untrusted input to reach a dynamic execution sink.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs the Playwright framework and Chromium browser from official Microsoft/Playwright sources. It also fetches CSS and JavaScript assets (like xterm.js and XP.css) from unpkg.com for UI rendering. These are well-known technology services used for the skill's primary functionality.
[INDIRECT_PROMPT_INJECTION]: The init flow utilizes an 'Explore agent' to analyze untrusted codebases. This creates a surface for indirect prompt injection if the codebase being analyzed contains malicious instructions hidden in comments or metadata designed to influence the agent's behavior.

llmer-demo