The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to automate environment setup and project scaffolding. Actions include running node, git, npx, pip, and python3 commands to check for and install dependencies, clone repositories, and execute internal scripts.
[EXTERNAL_DOWNLOADS]: The skill performs several external fetch and install operations:
Clones a template repository from https://example.com/skills/XBTI.git using git clone.
Installs the image-creator skill using npx skills add image-creator -g -y.
Installs Python packages google-genai and Pillow via pip install, specifically attempting to bypass system restrictions using --break-system-packages.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface for indirect prompt injection:
Ingestion points: User-provided inputs for "BTI名称" (Name), "主题" (Theme), and "风格偏好" (Tone) via AskUserQuestion (SKILL.md).
Boundary markers: None identified; user inputs are interpolated into generation prompts without explicit delimiters or instructions to ignore embedded commands.
Capability inventory: The skill possesses significant capabilities including file writing (Write, Edit), network access (git clone), and system-level command execution (Bash).
Sanitization: No sanitization or validation of user-provided theme strings is described before they are used to generate content and dimension systems.
[DYNAMIC_EXECUTION]: The workflow involves dynamic code and data handling:
Uses node -e in Step 9 to execute a one-liner script that merges multiple JavaScript data files into a case.json file.
Programmatically generates JavaScript files (dimensions.js, questions.js, types.js) which are subsequently incorporated into the project's runtime environment.

lov-xbti-creator