The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill explicitly promotes the use of dynamic code evaluation at runtime via the cx.eval(code_string) and cx.eval_with_context APIs.
Evidence: Found in the 'Execution' section of SKILL.md.
Context: The documentation suggests that AI can generate these scripts dynamically, which introduces risk if the generated code is not properly sandboxed or reviewed before execution.
[DATA_EXFILTRATION]: The Splash language provides built-in http.get and http.post methods which can be used to send data to external domains.
Evidence: let response = http.post("https://api.example.com/data", { body: { key: "value" } }); in SKILL.md.
Context: While shown with generic example domains, these functions provide the technical capability to exfiltrate data from the local environment if a malicious script is executed.
[INDIRECT_PROMPT_INJECTION]: The skill architecture creates a large attack surface for indirect prompt injection by encouraging the agent to process and execute externally sourced or AI-generated scripts.
Ingestion points: Data passed to cx.eval and scripts defined within the script! macro in SKILL.md.
Boundary markers: The skill includes a text-based warning stating 'Never evaluate model-generated, downloaded or user-content strings directly', though no technical enforcement is present.
Capability inventory: The scripting environment has access to network operations (http), asynchronous timers (timer), and UI manipulation (ui.widget).
Sanitization: No automated sanitization or safe-loading mechanisms are described for the dynamic script strings.
[METADATA_POISONING]: The skill frontmatter includes a self-assigned risk level that may attempt to influence automated security assessments.
Evidence: risk: critical field in the YAML frontmatter of SKILL.md.

makepad-splash