The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses curl within a bash script to interact with the OpenAI Images API. Variables like $PROMPT_A, $PROMPT_B, and [surface-slug] are interpolated directly into shell commands. If these values contain shell metacharacters (e.g., through a maliciously crafted Linear issue title or surface name), it could lead to arbitrary command execution on the host machine.
[EXTERNAL_DOWNLOADS]: The skill downloads image assets from OpenAI's API (api.openai.com) and saves them locally using base64 -d. While OpenAI is a well-known service, the skill retrieves this data over the network and executes a decoding utility on the output.
[REMOTE_CODE_EXECUTION]: The skill uses a Task tool to spawn a subagent that generates HTML/CSS files. While the subagent itself is part of the agent's internal capabilities, the generated HTML is written to the local filesystem and subsequently uploaded to Linear, creating a path where generated code is stored and distributed.

plan-design