The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions in SKILL.md for Phase 1 direct the agent to run the command python3 skills/meta/html-artifact/scripts/detect-shape.py --request "{user_request}". Because the {user_request} variable is not sanitized before being passed to the shell, it allows an attacker to perform command injection by including characters like ;, &, or ` in their prompt.
[REMOTE_CODE_EXECUTION]: Dynamic module loading is used across multiple files including scripts/validate-artifact.py and several scripts in scripts/tests/ via importlib.import_module(). This technique allows for the execution of code from computed paths at runtime.
[DATA_EXFILTRATION]: The scripts/render-github-issues.py script accesses private user information via the gh CLI, including GitHub issues and comments. While functional, this represents a significant data exposure surface as the sensitive information is then placed into HTML files that could be exfiltrated.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data via the {user_request} variable in SKILL.md and detect-shape.py without boundary markers or sanitization. The agent has capabilities like subprocess execution and file writing, which could be abused if the agent follows instructions hidden within the user-provided data.
[EXTERNAL_DOWNLOADS]: The skill references and suggests the installation of external Python packages like playwright and python-pptx to support PDF and PPTX export features.

html-artifact