The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions in SKILL.md and technical comments in scripts/render_check.mjs explicitly advise the agent to run scripts "outside the sandbox" if the environment restricts access to the temporary profile directory. This encourages the intentional bypassing of built-in agent security constraints.
[COMMAND_EXECUTION]: The scripts/render_check.mjs script uses the node:child_process.spawn function to launch headless browser binaries (such as Brave, Chrome, or Chromium) from the host system. It configures these instances with specific flags, including custom user data directories and remote debugging ports.
[REMOTE_CODE_EXECUTION]: The scripts/upgrade_deck.mjs script fetches updated HTML shells containing minified JavaScript (the Bento runtime) from the vendor's release site at bento.page and uses them to overwrite the local .bento.html file. While these are vendor-provided resources, this mechanism allows for remote updates of executable content within the user's workspace.
[DATA_EXFILTRATION]: The skill processes Bento slide decks which often contain collab objects with sensitive session keys (ownerPriv). These keys grant administrative access to live collaborative presentation sessions. The presence of these credentials in files processed by the agent, combined with the agent's network capabilities, poses a risk of accidental data exposure.
[DYNAMIC_EXECUTION]: The scripts/render_check.mjs tool uses the Chrome DevTools Protocol (CDP) to evaluate JavaScript expressions within the headless browser context. This allows the execution of dynamic logic against the presentation data at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and parses complex HTML and JSON data from user-provided slide decks. This creates a surface for indirect prompt injection where malicious instructions embedded in a presentation could influence the agent's behavior, particularly given its capabilities to write files and execute commands.

bento-slides