The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted external data, including JavaScript/TypeScript bundles, WebAssembly (.wasm) binaries, and Electron (.asar) archives. This creates a significant surface for indirect prompt injection where malicious instructions could be embedded within the source code or metadata of the target applications to influence the agent's behavior.
Ingestion points: Target web bundles, WASM artifacts, and Electron archives processed by the REA MCP tools.
Boundary markers: No boundary markers or "ignore instructions" warnings are implemented in the skill's instructions.
Capability inventory: Extensive. The agent can write to the file system, unpack archives, and execute shell commands (npm, wasm2wat).
Sanitization: There is no evidence of sanitization or safety checks performed on the reconstructed code before it is written to the workspace or executed.
[COMMAND_EXECUTION]: The execution pipeline explicitly directs the agent to verify the reconstruction by running npm install && npm run build. This pattern executes shell commands within the user's environment. If the reconstructed package.json or build scripts are manipulated by a malicious input artifact, this leads to the execution of arbitrary code via npm lifecycle hooks.
[EXTERNAL_DOWNLOADS]: The instruction to run npm install involves downloading numerous external dependencies from the npm registry based on the reconstructed project configuration, which is derived from untrusted input data.

rea-web-bundle-recovery