The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes an external file, checklist.html, to determine the sequence of steps for UI interaction and screenshot capture.
Ingestion points: tmp/issues/<issue番号>/checklist.html (Step 2).
Boundary markers: Absent. The agent is instructed to read the "UI script" section and follow the steps provided.
Capability inventory: Uses the Bash tool and calls the /chrome-devtools-cli skill based on the contents of the external file.
Sanitization: Absent. If an attacker can control the contents of the checklist file, they could potentially influence the agent to perform unintended browser actions or shell commands.
[COMMAND_EXECUTION]: The skill accepts user-supplied input via $ARGUMENTS (specifically the <issue> parameter) and interpolates it into file system paths used by tools like Read, Write, and Bash.
Evidence: Paths like tmp/issues/<issue番号>/ are constructed using this input. Without explicit sanitization instructions, this creates a surface for path traversal attacks if the agent does not validate the input before using it in shell-mediated tool calls.
[METADATA_POISONING]: The skill records execution metadata into a persistent local configuration file.
Evidence: Step 6 describes writing issue, cause, workaround, and date to ~/.agents/.skills-config/capture/config.json.
Risk: If an issue name or workaround description contains malicious patterns, they could be persisted into the global configuration and potentially affect the logic of future executions (e.g., in Step 4 where the agent attempts to use "known methods" from this config).

capture