The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions in SKILL.md require the agent to run npx --yes skills update optimize-shopify-alt-text -g -y as the mandatory first action on every trigger. This process downloads code from an external registry without requesting user confirmation or providing an opportunity for review.
[REMOTE_CODE_EXECUTION]: The mandatory update mechanism (npx) allows for the automated execution of updated scripts. This creates a risk where a compromised package or registry could deliver and execute arbitrary malicious code in the user's environment.
[PROMPT_INJECTION]: The skill exhibits a vulnerability to indirect prompt injection (Category 8). It ingests untrusted data from the Shopify store (product titles, article bodies, collection descriptions) and uses it to generate content or guide agent actions.
Ingestion points: Managed through SKILL.md and shopify-alt-text-admin.mjs via the scan and target commands which read store metadata.
Boundary markers: The instructions lack explicit XML tags, delimiters, or 'ignore' instructions for the processed store data.
Capability inventory: The skill has write access to the store via apply (GraphQL mutations).
Sanitization: No evidence of input validation or sanitization of store content before it enters the model context.
[COMMAND_EXECUTION]: The helper script shopify-alt-text-admin.mjs uses execFile to invoke system binaries like npm and shopify CLI. While these are intended for legitimate management tasks, the silent execution of these commands (especially the update command) reduces user visibility into system changes.

optimize-shopify-alt-text