The Agent Skills Directory

[DATA_EXFILTRATION]: The readArg function in scripts/lib/run.mjs interprets any argument starting with the '@' character as a file path and reads its full content using readFileSync. This provides a mechanism for the agent to access sensitive files (e.g., ~/.ssh/id_rsa, .env, or configuration files) and include their contents in the model request. The content is then transmitted to the OpenRouter API, posing a high risk of sensitive data exposure.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted user input via the --brief parameter and interpolates it directly into the model prompt in scripts/lib/prompts.mjs.
Ingestion points: The input variable in scripts/lib/run.mjs (derived from the --brief argument or a file) is the primary entry point for untrusted data.
Boundary markers: The SCRIPT_USER_PROMPT in scripts/lib/prompts.mjs lacks any delimiters (like XML tags or triple quotes) or system instructions to ignore embedded commands within the provided brief.
Capability inventory: The skill possesses file-reading (readFileSync), file-writing (writeFileSync), and network communication capabilities (via the studio-core dependency).
Sanitization: There is no evidence of input validation, escaping, or filtering for the data provided in the brief.
[COMMAND_EXECUTION]: The skill includes a shell wrapper script (scripts/run.sh) that executes a Node.js process (scripts/lib/run.mjs). While this is standard for the skill's operation, it establishes a local execution path that handles file system operations and environment variables.

studio-script