The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text from user arguments or conversation history and interpolates it into a file that is subsequently rendered in a browser.
Ingestion points: $ARGUMENTS and previous conversation response text processed in SKILL.md.
Capability inventory: Write tool for local file modification and Bash tool for shell command execution.
Boundary markers: The skill lacks explicit boundary markers or instructions for the agent to ignore instructions embedded within the processed text.
Sanitization: The instructions rely on the AI agent to correctly strip markdown and escape characters for JavaScript, which is prone to error and bypasses.
[DYNAMIC_EXECUTION]: The skill assembles executable JavaScript code at runtime by injecting user-controlled text into a script tag.
Evidence: Instruction 3 in SKILL.md directs the agent to replace an HTML comment with a <script> tag containing a string assignment: window.SPEED_READER_CONTENT = "your escaped text";.
Impact: If an attacker provides text that breaks out of the string literal (e.g., using "; alert(1); //), they can execute arbitrary JavaScript in the context of the file:// protocol when the browser opens the reader.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a system command that opens a local file.
Evidence: Instruction 3 in SKILL.md executes open ~/.claude/skills/speed/data/reader.html to launch the browser.

speed