The Agent Skills Directory

[COMMAND_EXECUTION]: The skill starts a Node.js HTTP server (defaulting to port 3500) to serve the dashboard and an API. It also utilizes the child_process module to automatically open the system's default browser when the server starts.
[DATA_EXFILTRATION]: The server includes a /file/* route designed to serve local files from the filesystem to the dashboard. Although it implements path validation to prevent directory traversal (checking for '..' and validating against allowed base directories), the server can be configured to bind to all network interfaces (--host 0.0.0.0). This configuration could expose files within the current working directory or the specified plans directory to other devices on the local network.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via a Cross-Site Scripting (XSS) vulnerability. In scripts/lib/dashboard-renderer.cjs, plan metadata (such as titles and descriptions) is extracted from markdown files and serialized into a JSON string. This string is then injected directly into a <script> tag in the HTML template using a simple string replacement. Since JSON.stringify does not escape HTML tags, a maliciously crafted plan.md file containing a </script> sequence could break out of the data context and execute arbitrary JavaScript in the user's browser.
Ingestion points: Reads and parses plan.md files from directories provided by the user.
Boundary markers: None implemented to separate untrusted plan data from the application's executable context.
Capability inventory: Reads local files, hosts a network server, and triggers browser execution.
Sanitization: While an escapeHtml function is used for some UI elements, it is not applied to the JSON data injected into the dashboard's initialization script.

plans-kanban