The Agent Skills Directory

[COMMAND_EXECUTION]: Instructions in SKILL.md (Phase 2, Step 5) direct the agent to execute a shell command (python3 scripts/generate_image.py) using a --prompt argument that is dynamically generated from user-provided article text. This construction lacks escaping mechanisms, creating a risk of command injection if the generated prompt contains shell metacharacters.
[DATA_EXFILTRATION]: The skill hardcodes absolute file paths to a specific user's home directory (/Users/ugreen/Documents/obsidian/) for reading context and writing image files. This practice exposes the local user's environment structure and may facilitate unauthorized access to files within the user's home directory.
[EXTERNAL_DOWNLOADS]: The skill's Python script interacts with api.labnana.com, an external service for image generation. Although this is the primary function, it involves sending user-derived data (prompts) to a third-party domain that is not a well-known service or trusted organization.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it processes untrusted article content to drive its logic. 1. Ingestion points: Reads article text from local files (SKILL.md, Phase 1). 2. Boundary markers: No delimiters or safety instructions are provided to isolate the article content from the agent's instructions. 3. Capability inventory: The skill can execute local shell commands, write to the filesystem, and perform network requests. 4. Sanitization: No validation or filtering is performed on the ingested content before it is used to generate command-line arguments.

space-ai-article-illustration