The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to install and execute the designlang package from the NPM registry using npm install -g designlang or npx designlang. This package is from an unknown source and is not pinned to a specific version, which introduces a supply chain risk where a malicious package or a compromised update could execute arbitrary code on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external website URLs, which is a significant attack surface for indirect prompt injection.
Ingestion points: Untrusted content is fetched from websites via the npx designlang <url> command and saved to files like design-extract-output/*-design-language.md, as described in SKILL.md.
Boundary markers: The skill lacks any delimiters or instructions to the agent to treat the fetched content as data rather than instructions, making it possible for an attacker to embed malicious prompts in a website's metadata or text.
Capability inventory: The skill uses Bash, Read, Write, and Glob tools, providing a broad capability set that could be abused if the agent inadvertently follows instructions embedded in the scraped data.
Sanitization: There is no evidence of sanitization, filtering, or validation of the content extracted from the target URLs before it is presented to the agent for analysis.

extract-design