The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill contains a testing utility example under 'Code Examples Testing' that uses the eval() function to execute JavaScript code extracted directly from a README.md file. This is a dangerous pattern because it executes arbitrary strings as code, which can lead to code execution vulnerabilities if the source file is modified by an external actor.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates a workflow for ingesting and processing untrusted data from documentation files through a dynamic execution path.
Ingestion points: Reads content from README.md using readFileSync in the provided test script.
Boundary markers: The script uses regex to find markdown code blocks but does not include any validation or boundary markers to ensure the code is safe to execute.
Capability inventory: Uses eval() to execute the extracted strings, which allows full access to the execution environment.
Sanitization: No sanitization or sandboxing is present in the provided example.

documentation-generation