The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/package-loader.mjs implements a custom dependency bootstrapper that downloads and installs NPM packages at runtime to a temporary directory.
It uses spawnSync to execute npm install for packages like @hyperframes/producer, @hyperframes/core, and sharp.
It utilizes dynamic import() to load code from these computed installation paths.
It re-executes the current process using spawnSync(process.execPath, ...) to inject the temporary node_modules path into the environment.
While the script includes hardening measures such as --ignore-scripts and interactive confirmation, the pattern of self-modifying execution environments remains a security risk.
[COMMAND_EXECUTION]: The script scripts/extract-audio-data.py executes shell commands using subprocess.run().
Specifically, it spawns ffmpeg to decode audio and video files provided as command-line arguments.
The implementation uses argument lists rather than raw shell strings, which mitigates simple injection, but still relies on an external binary for processing untrusted media files.
[INDIRECT_PROMPT_INJECTION]: The design picker workflow described in references/design-picker.md and implemented in templates/design-picker.html creates a vulnerability surface for cross-site scripting (XSS).
Ingestion points: User-supplied headlines and sublines are ingested from the agent context.
Boundary markers: Missing; the content is directly interpolated into HTML template strings ({{prompt_headline}}, {{prompt_sub}}).
Capability inventory: The interpolated content is rendered in a browser context using innerHTML within templates/design-picker.html.
Sanitization: The documentation claims architecture preview_html must not contain scripts, but there is no programmatic enforcement; sanitization relies entirely on the LLM's adherence to instructions.

hyperframes-creative