The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from conversation history and external files to generate HTML reports. There is no evidence of sanitization or escaping of this content, which could allow an attacker to inject malicious scripts into the generated HTML. These scripts would then execute when the user opens the report or when the agent takes screenshots using Chrome DevTools.
Ingestion points: Conversation content and user-specified .html files.
Boundary markers: None specified in instructions.
Capability inventory: Write (file creation), Bash (execution of 'crit'), mcp__chrome-devtools__* (browser interaction and screenshots).
Sanitization: No explicit sanitization or filtering of interpolated data is described.
[COMMAND_EXECUTION]: The skill executes shell commands using the 'crit' tool. While it attempts to use kebab-case for filenames, if the sanitization of the topic name is insufficient, it could be vulnerable to command injection through shell metacharacters.
[DYNAMIC_EXECUTION]: The skill generates HTML files that include inline JavaScript for UI functionality (such as the Table of Contents toggle). Generating and executing active content based on potentially untrusted input increases the risk profile of the skill.

report