The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to upload captured screenshots to external services. It accepts file:// URLs, allowing it to access and screenshot local system files, which are then uploaded to 0x0.st, a public, anonymous, and unauthenticated file-hosting service. This behavior poses a significant risk of exposing proprietary UI designs or sensitive local file contents to the public internet.
Evidence: SKILL.md states the tool "Accepts two URLs (file://, http://, https://)".
Evidence: scripts/adapters/0x0st.sh uses curl to send files to https://0x0.st.
Evidence: SKILL.md documents 0x0.st as the default hosting provider.
[DYNAMIC_EXECUTION]: The upload-and-copy.sh script dynamically determines which adapter script to execute based on the IMAGE_ADAPTER environment variable. This allows the execution of different shell scripts within the scripts/adapters/ directory based on runtime configuration.
Evidence: scripts/upload-and-copy.sh executes "$ADAPTER_SCRIPT" "$file" where the script path is derived from an environment variable.
[COMMAND_EXECUTION]: The skill performs several sensitive operations using command-line tools, including environment inspection and project modification.
Evidence: Uses gh pr edit to modify the content of Pull Request descriptions.
Evidence: Uses vercel inspect to retrieve bypass tokens for protected Vercel deployments.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation and execution of external software from the NPM registry.
Evidence: allowed-tools includes npm install -g @vercel/before-and-after and npx @vercel/before-and-after for obtaining the comparison utility from a well-known service.
[INDIRECT_PROMPT_INJECTION]: The skill processes external URLs and images and uses the resulting data to modify Pull Request bodies via the GitHub CLI. This creates a potential surface where malformed data processed during the screenshotting or uploading phase could influence the content of a PR modification.
Ingestion points: User-provided URLs and image paths in SKILL.md.
Boundary markers: None identified in the prompt interpolation process.
Capability inventory: gh pr edit, Bash execution, and file system writes.
Sanitization: No explicit sanitization of the generated markdown content before applying it to the PR.

before-and-after