The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The installation instructions require cloning a repository from an untrusted GitHub account (https://github.com/Kevin100202/Rocket-Design-and-Manufacturing-Automation-Program-from-Shenzhen22highschool.git).
[REMOTE_CODE_EXECUTION]: The skill directs users to execute code from the downloaded repository using npm install, npm run build, and npm start. This allows the external repository to execute arbitrary commands on the user's system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from an external rocket-config.json file and environment variables, which are then used to control design workflows and file output operations.
Ingestion points: Reads configuration from rocket-config.json and various environment variables such as ROCKET_OUTPUT_PATH and ROCKET_UNITS.
Boundary markers: None provided; the skill appears to trust the content of the configuration files implicitly.
Capability inventory: File system write access (generator.export to SVG/PDF, workflow.exportPackage to a user-defined output path), and console output.
Sanitization: There is no evidence of sanitization or path validation for the outputPath parameter derived from external configuration, potentially allowing for path traversal or writing to sensitive locations.

shenzhen22-rocket-design-automation