The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection and shell expansion vulnerability surface through its 'Copy as command' feature.
Ingestion points: scripts/render.js reads untrusted query data from the wiki_seeds table in the local SQLite database (~/.pro-workflow/data.db), which holds data collected during research loops.
Boundary markers: Completely absent. No safeguards or warnings are provided to prevent the execution of embedded command payloads.
Capability inventory: scripts/render.js possesses file-system write capabilities via fs.writeFileSync to generate the HTML file artifact.
Sanitization: The script relies solely on JSON.stringify() to escape the query content. While this prevents basic quote breaking, it does not sanitize shell expansions or command substitutions (e.g., $(command) or `command`), which will be evaluated if the copied string is pasted into a Unix shell environment.

wiki-viewer