The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes complex external vector and document formats (SVG, PDF, DXF, EPS) using the app.open and document.inspect methods. Maliciously crafted files could contain instructions in metadata or text fields to influence agent behavior.
Ingestion points: Documents loaded via app.open, file.open, and file.place as described in SKILL.md and references/control-protocol.md.
Boundary markers: There are no explicit instructions or delimiters provided to prevent the agent from obeying instructions embedded within the document structure.
Capability inventory: Access to file system writes (app.save), workspace capture (ui.screenshot), browser redirection (attributes.openUrl), and plugin installation (ui.installPlugin).
Sanitization: The skill does not mention any validation or sanitization of document content before it is added to the agent's context.
[DYNAMIC_EXECUTION]: The ui.installPlugin command in references/control-protocol.md allows the installation and execution of .wasm binary files. Loading unverified plugins poses a risk of arbitrary code execution within the application context.
[COMMAND_EXECUTION]: The skill operates by executing local binaries vectorcraft-cli and vectorcraft. The control protocol runs over a loopback TCP port without authentication, which is noted as a security trade-off in the documentation.
[DATA_EXFILTRATION]: The skill can capture user workspace content using ui.screenshot and ui.render. Additionally, the attributes.openUrl command can be used to open arbitrary URLs in a web browser, representing a potential data exfiltration vector if sensitive information is passed via URL parameters.
[EXTERNAL_DOWNLOADS]: The skill references external protocol documentation and source repositories hosted on a public GitHub account (github.com/storytold/vectorcraft).

vectorcraft