The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/mirror-site.mjs contains a path traversal vulnerability in the urlToLocalPath function. By failing to sanitize directory traversal sequences such as .., a malicious website being cloned could cause the agent to write files outside the intended project directory during the mirroring process.
[PROMPT_INJECTION]: Instructions in SKILL.md command the agent to override its default behavior by explicitly distrusting its own generated code (“祝不信 AI 推测的代码”) and assuming all AI-generated executable blocks are fabricated.
[REMOTE_CODE_EXECUTION]: The utility scripts/lib/playwright-loader.mjs performs dynamic loading of the playwright library from the current working directory or from an environment-defined path. This computed loading pattern introduces risk if the execution environment is manipulated.
[EXTERNAL_DOWNLOADS]: The skill utilizes multiple scripts, including asset-harvest.mjs, mirror-site.mjs, and sourcemap-hunt.mjs, to download assets, source maps, and entire site structures from user-specified remote URLs.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes untrusted data from external websites (HTML, scripts, and metadata) via Playwright-based tools (recon-site.mjs, interaction-probe.mjs).
Ingestion points: Website DOM content and network responses processed by reconnaissance scripts.
Boundary markers: None identified for ingested content.
Capability inventory: File writing (fs.writeFileSync) and execution of local Node.js scripts.
Sanitization: Basic filename sanitization is present, but path sanitization for mirroring is insufficient.

web-clone