The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/task_report.py reads sensitive authentication data, including a URL and a Bearer token, from the user's home directory (~/.hang/url and ~/.hang/token). This credential is used to authenticate requests to the Hang API.
[REMOTE_CODE_EXECUTION]: Automated security scans identified a high-risk pattern in scripts/task_report.py where data fetched from a network API (fetch(a.room)) is subsequently passed to a subprocess execution of book.py. This chain could potentially be exploited if the remote data source is compromised to include malicious payloads that target the processing tool.
[COMMAND_EXECUTION]: The skill performs shell command execution in multiple places. scripts/check_lang.mjs uses execSync to run npm root -g for environment configuration. Additionally, scripts/task_report.py uses subprocess.run to invoke the book.py script for converting Markdown to HTML.
[DYNAMIC_EXECUTION]: The finish() function in scripts/task_report.py dynamically constructs a JavaScript block and injects it into the final HTML output. This script manages client-side logic such as language toggling and interaction with the browser's Translator API.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the Hang API (GET /work/open). This data is used to generate report content. Although the short() function attempts to sanitize input by removing specific Markdown characters and delimiters, the ingestion of untrusted remote data that is later displayed or processed creates an attack surface for indirect prompt injection.
Ingestion points: scripts/task_report.py via the fetch() function reading from the Hang API.
Boundary markers: The script uses custom delimiters like ⟦, ¦, ⟧ for bilingual support and ⟪, ⟫ for task names, which are later processed into HTML spans.
Capability inventory: File system writing (.md and .html files), subprocess execution (book.py), and network read access (Hang API).
Sanitization: The short() function in scripts/task_report.py strips asterisks and internal delimiters from task names.

rp