The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script verify_html.sh extracts JavaScript code from reports generated by the agent and executes it using the node -e command. This mechanism, used to check for rendering errors, could be exploited if malicious content from external data sources is incorporated into the report's script block.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data, including Supabase API results and workshop transcripts. There is a risk that these untrusted inputs could contain hidden commands aimed at overriding agent instructions.
Ingestion points: processes.json, scores.json, reports.json (retrieved via API), and meeting-notes.txt.
Boundary markers: The skill instructs the agent to differentiate between AI-synthesized and workshop-captured data (whiteboard photos).
Capability inventory: Network access via curl, execution of python3 and node scripts, and local file creation/modification.
Sanitization: A syntax and render check is performed on generated HTML files via verify_html.sh.
[EXTERNAL_DOWNLOADS]: Fetches process data and reports from Supabase's infrastructure using curl within the fetch_all.sh and fetch_process.sh utility scripts.
[COMMAND_EXECUTION]: The skill uses several shell scripts to perform tasks like data retrieval, ranking, and output verification, which involve running curl, python3, and node on the local system.

processflow-review