The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is explicitly designed to execute shell commands to run and verify code prototypes. The workflow includes a 'run' step that executes variant/harness commands and captures their output and exit codes. This is a core feature but represents a high-risk capability if misused.
Evidence: Found in SKILL.md under the 'Workflow' section (Step 4: run) and the 'Failure Paths' table.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection as it ingests untrusted data (specifications, tickets, screenshots, and design references) to generate and execute code.
Ingestion points: SKILL.md argument-hint (idea, screenshot, spec, ticket, code, or design reference).
Boundary markers: The skill instructions include extensive 'Approval Continuity' and 'Execution Boundary' sections to prevent unauthorized actions.
Capability inventory: Shell execution of generated code, reading local files for report packaging, and generating interactive HTML/JS reports.
Sanitization: The scripts/build_html.py script validates HTML fragments and explicitly rejects script and style tags in body content to prevent XSS. The scripts/package_html.py script prevents the inclusion of hidden files (e.g., .env, .ssh) in exported reports.
[DATA_EXFILTRATION]: The scripts/package_html.py utility can bundle multiple local files into a single HTML report by encoding them in Base64. While this is a portability feature for prototypes, it could theoretically be used to package sensitive data if the agent's file allowlist is manipulated.
Mitigation: The script includes a check that raises a ValueError if a requested path contains hidden components (starting with a dot) or attempts to escape the root directory using relative paths.
[CREDENTIALS_UNSAFE]: The skill includes specialized logic for managing 'Worktree-local application authentication' for non-production environments. It instructs the agent to store session material in .tigerkit/secret-input/ with restricted filesystem permissions (0700 for directories, 0600 for files). While this follows security best practices for local secret management, it establishes a mechanism for handling credentials within the skill's operational scope.
Evidence: Detailed in references/authentication.md and references/artifact-paths.md.
[DYNAMIC_EXECUTION]: The skill generates and assembles HTML, CSS, and JavaScript artifacts at runtime to facilitate prototype reporting and visualization. This involves using Python scripts to highlight source code and assemble document fragments into a final viewer shell.
Evidence: Implementation found in scripts/build_html.py, scripts/highlight_code.py, and scripts/package_html.py.

tk-prototype