The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from files, variables, or recent output to generate browser-based views. \n
Ingestion points: Data is sourced from external files and recent agent output (SKILL.md, Workflow step 1). \n
Boundary markers: The instructions lack specific delimiters to isolate untrusted data within the HTML template. \n
Capability inventory: The skill has the ability to write HTML files to the _private/views/ directory and execute shell commands to open them. \n
Sanitization: No HTML escaping or sanitization requirements are defined for the {content} placeholder in the base template, allowing potentially malicious HTML or scripts to be rendered. \n- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute the open command (e.g., open _private/views/{filename}) to automatically launch the user's default browser. This execution happens immediately after file generation, which may lead to the unintended execution of injected scripts before a user can inspect the file. \n- [DYNAMIC_EXECUTION]: The skill generates HTML files that include embedded JavaScript for managing data truncation and draft editing (references/full-guide.md). These scripts utilize localStorage and navigator.clipboard, which could be exploited if malicious content is successfully injected into the generated page.

quick-view