The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to use the 'Vite+' CLI tool and provides a link to https://viteplus.dev/guide/global-cli. It also uses pnpm dlx or vp dlx to fetch and execute packages from the npm registry.
[COMMAND_EXECUTION]: Step 6 in SKILL.md contains a shell command for linting generated documents: vp dlx --package comark-linter --package comark-ui lint-comark review.md. This command is intended to be run in the agent's environment.
[DYNAMIC_EXECUTION]: The use of dlx (either via vp or pnpm) involves fetching code from a remote registry and executing it immediately, which is a form of dynamic remote code execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted 'review findings' which are then formatted into a Markdown document. Maliciously crafted findings could attempt to influence the agent's behavior during the document generation or subsequent linting phase.
Ingestion points: User-provided findings described in Steps 1-3 of SKILL.md.
Boundary markers: None identified to separate user data from instructions.
Capability inventory: Subprocess execution via shell commands (vp dlx).
Sanitization: No sanitization or validation of the input findings is specified.

review-document