The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides command templates (e.g., npm start -- "TASK_DESCRIPTION") that interpolate user-provided strings directly into a shell environment. This pattern is vulnerable to command injection because shell-active characters like backticks or command substitution sequences (e.g., $(...)) are still evaluated by most shells even when enclosed in double quotes.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection vulnerability surface. 1. Ingestion points: User-supplied task descriptions, test scenarios, and session names in SKILL.md. 2. Boundary markers: The skill uses double quotes in shell templates but lacks explicit instructions to the agent to ignore or sanitize embedded commands within the input. 3. Capability inventory: Execution of local scripts via npm start and visual GUI control via the Peekaboo MCP server. 4. Sanitization: No input validation or sanitization is specified.
[DATA_EXFILTRATION]: The core functionality of the 'User Research Recorder' and 'Design QA Validator' agents involves capturing screenshots and recording user sessions. This capability allows for the collection and potential exposure of sensitive visual information displayed on the user's screen.
[EXTERNAL_DOWNLOADS]: The instructions note that npm install may be required within the local project directories. This involves fetching and executing third-party code from the npm registry, which is a standard but unverifiable remote dependency source.

peekaboo