The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/render_promo.py generates temporary HTML files for rendering by directly interpolating values from the promo.json manifest into a <style> block and HTML attributes. Fields such as bg, fg, and sub in the theme configuration, as well as the frame property, are not escaped or validated against a whitelist. This enables arbitrary CSS and JavaScript injection into the headless browser environment during the rendering process.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes a JSON manifest (promo.json) that may be generated or modified by the AI agent based on untrusted external data (e.g., brand guidelines or color palettes fetched from the web).
Ingestion points: The promo.json file, specifically the theme and slides objects, which control the rendering parameters.
Boundary markers: Absent; the skill instructions do not include warnings to the agent regarding the sanitization of configuration values.
Capability inventory: The skill invokes a headless browser using subprocess.run with the --allow-file-access-from-files flag. This permission allows any injected script to read and potentially exfiltrate local system files that the browser can access.
Sanitization: Partial; while html.escape is correctly applied to user-provided text elements like headlines and subtitles, it is completely absent for values injected into CSS variables and HTML class attributes.
[COMMAND_EXECUTION]: The script scripts/render_promo.py uses subprocess.run to launch external browser binaries (Google Chrome, Chromium, or Microsoft Edge). While the command is constructed as a list, preventing standard shell injection, the browser's execution context is compromised by the unsanitized HTML content it is directed to render. The static analysis hint regarding shell command execution is a false positive as the implementation uses list-based arguments, but the browser's capabilities (file access) make the execution context high-risk.

store-promo-shots