The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It ingests untrusted data from the $ARGUMENTS variable or the previous conversation history and interpolates this content directly into a tag within a local HTML file. Ingestion points: $ARGUMENTS and previous conversation response in SKILL.md. Boundary markers: No explicit delimiters or boundary markers are used to isolate the injected content from the surrounding script logic. Capability inventory: The skill utilizes the Write tool to modify local files and the Bash tool to execute the open command. Sanitization: The instructions recommend stripping markdown and escaping quotes and backslashes, but this manual sanitization performed by the LLM is prone to bypasses (e.g., via closing script tags or advanced XSS payloads).
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute the open command. This command is used to launch the default system handler for the modified reader.html file, which could result in arbitrary code execution in the browser context if the injected content contains malicious JavaScript.

speed