The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/prepare_chat_overlay_bundle.py can be used to copy sensitive local files into a distributable Remotion bundle. The uploadPath configuration field, intended for custom avatars, lacks validation for file types or source directory restrictions. This allows a malicious user or a prompt-injected transcript to trick the system into harvesting files such as ~/.ssh/id_rsa, .env files, or cloud credentials and placing them in a public directory for potential exfiltration.
[COMMAND_EXECUTION]: The test utility scripts/run_test_matrix.py executes multiple system commands using the subprocess module. While it avoids direct shell injection by using list-based arguments, it accepts several directory paths (--work-dir, --node-modules) as command-line inputs. If these arguments are provided by an untrusted source, it could result in the execution of unintended binaries or manipulation of files outside the intended project scope.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it processes untrusted data from transcripts and screenshots.
Ingestion points: scripts/build_chat_overlay_spec.py parses transcript lines and metadata.
Boundary markers: None identified in the parsing logic to distinguish instructions from content.
Capability inventory: scripts/prepare_chat_overlay_bundle.py performs file reads/writes and directory manipulation.
Sanitization: The script validates config field values but does not sanitize the uploadPath against path traversal or verify that files are valid images, allowing injected data to trigger unauthorized file access.

chat-motion-overlay