The Agent Skills Directory

[DATA_EXFILTRATION]: The collect.mjs script contains a localize function that resolves and copies files from arbitrary paths on the host system. It explicitly supports resolving the home directory (~) and absolute paths. If a candidate JSON file (which can be populated by data from external sources) contains a sensitive file path in the media field, the script will copy that file into the public-facing board directory and serve it via the local web server.
Evidence: collect.mjs lines 122-132.
[COMMAND_EXECUTION]: The skill instructs the agent to execute a Node.js script (collect.mjs) shipped with the skill. This script is granted significant capabilities, including reading/writing arbitrary files, performing network requests, and hosting a local HTTP server, which significantly expands the attack surface if the script's logic is subverted.
Evidence: SKILL.md shell block in section 5.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from various external inspiration sources (Pond, marked.dev, Are.na, Mobbin, etc.). This creates a vulnerability surface where malicious instructions embedded in the titles, notes, or metadata of these external references could influence the agent's behavior during the gathering and labeling process.
Ingestion points: collect.mjs processes JSON files in the candidates/ directory, which are generated from external web content and APIs.
Boundary markers: No explicit delimiters or safety instructions are used when the agent processes the external references.
Capability inventory: The skill has the ability to read/write files and perform network operations via the collect.mjs script.
Sanitization: No sanitization or validation of the content retrieved from external sources is performed before the agent processes it.

gather