The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute several shell commands, including rsync, ln, cp, and npm/bun, to set up a temporary work directory and launch a Next.js development server.
[DATA_EXFILTRATION]: A high-severity finding involves the instruction to copy files from a user-provided path into a web-served directory: cp "$USER_PATH" template/public/images/. Without validation of the source path, an attacker or a malicious indirect prompt could trick the agent into exposing sensitive files (such as SSH keys, .env files, or cloud credentials) by making them accessible through the local web server.
[REMOTE_CODE_EXECUTION]: The skill implements dynamic code generation by directly interpolating user-provided text into a TypeScript source file (src/slides.ts). The absence of sanitization or escaping logic creates a code injection vulnerability where a payload could break the string literal context and execute arbitrary JavaScript code in the environment when the agent runs npm run dev.
[EXTERNAL_DOWNLOADS]: The skill performs external package installation via npm install to fetch dependencies during the setup phase.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted data from user posts and external websites used for branding.
Ingestion points: User-provided text inputs, local markdown files, and content scraped from external websites to populate design.md.
Boundary markers: Absent. The instructions do not define delimiters or provide the agent with warnings to ignore embedded instructions in the source text.
Capability inventory: The skill possesses powerful capabilities including file system writes, file copying, and the ability to launch a local web server running dynamically generated code.
Sanitization: None. The skill does not implement any escaping or validation for the content injected into the src/slides.ts template.

threads-carousel