The Agent Skills Directory

[DATA_EXFILTRATION]: The scripts/deploy.sh script is vulnerable to path traversal. It uses a regular expression to extract asset references (src, href, url) from HTML files and copies those files into a deployment bundle without verifying that they remain within the project's directory. This allows for the accidental exfiltration and public hosting of sensitive files (e.g., SSH keys or environment files) if they are referenced via parent directory paths (e.g., ../../.env). A similar path traversal vulnerability exists in the local HTTP server created by scripts/export-pdf.sh, which could be exploited by malicious HTML to include sensitive local files in the generated PDF.
[PRIVILEGE_ESCALATION]: The scripts/deploy.sh script attempts to perform a global package installation (npm install -g vercel) if the Vercel CLI is missing. Global installations typically require administrative privileges and are considered an intrusive action for a skill to perform without explicit confirmation.
[DYNAMIC_EXECUTION]: The scripts/export-pdf.sh script uses a "here document" to generate a temporary Node.js script (export-slides.mjs) at runtime. This script is used to orchestrate a headless browser and a local file server. While the generation template is provided within the shell script, this pattern of creating and executing scripts at runtime increases the complexity and attack surface of the skill.
[COMMAND_EXECUTION]: The skill relies heavily on shell command execution to perform its primary functions, including file manipulation, media processing, and interacting with third-party cloud services (Vercel) and browser automation tools (Playwright).
[EXTERNAL_DOWNLOADS]: The skill downloads and installs several external dependencies from trusted registries, including python-pptx and Pillow via pip, and vercel and playwright via npm. It also triggers the download of the Chromium browser binary. These downloads originate from well-known technology vendors.
[INDIRECT_PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection as it ingests and processes untrusted data from PowerPoint files and external directories. 1. Ingestion points: PowerPoint content extraction via scripts/extract-pptx.py and image folder scanning in SKILL.md (Step 1.2). 2. Boundary markers: Absent; the skill does not explicitly isolate or sanitize the ingested content from the agent's decision-making context. 3. Capability inventory: Shell execution and network deployment via scripts/deploy.sh, and dynamic code generation via scripts/export-pdf.sh. 4. Sanitization: Absent; text extracted from external documents is treated as trusted content for the slide generation process.

frontend-slides