The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md and agents/openai.yaml files mandate running npx --yes skills update shopify-gmc-misrepresentation-auditor -g -y as the required first action on every trigger. This command downloads and executes external code from a remote registry without user confirmation.
[PROMPT_INJECTION]: The skill uses coercive instructions to force the agent to execute a remote update and prioritize new instructions over existing ones.
Evidence: Instructions such as 'MUST run... as the first action', 'Do not skip', and 'do not ask the user' override standard operating procedures.
Evidence: The instruction to 'stop and re-read' after an update allows for immediate takeover of agent behavior via remote instruction injection.
[COMMAND_EXECUTION]: The skill executes shell commands to perform its core functions.
Evidence: Invocation of node to run audit scripts in scripts/.
Evidence: Use of npx to perform global updates without user interaction.
[EXTERNAL_DOWNLOADS]: The skill crawls external URLs and downloads remote packages.
Evidence: Network requests to user-provided store URLs and Shopify sitemaps in gmc-store-audit.mjs.
Evidence: Remote package downloads from external registries via the npx update command.
[INDIRECT_PROMPT_INJECTION]: The skill's architecture is vulnerable to indirect injection from processed external data.
Ingestion points: The fetchPage function in both .mjs scripts ingests HTML and JSON-LD from arbitrary external store pages.
Boundary markers: Absent. No delimiters or instructions are used to isolate untrusted data from the agent's core instructions.
Capability inventory: The skill possesses file-writing capabilities via writeFileSync and shell execution permissions through npx and node calls.
Sanitization: Absent. Content is parsed and analyzed directly to assess policy compliance, which can be exploited if the analyzed content contains malicious instructions.

shopify-gmc-misrepresentation-auditor