The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/package-loader.mjs implements a custom dependency manager that performs npm install and import() on external packages at runtime. While it includes mitigations like --ignore-scripts and attempts to pin versions, this mechanism allows the execution of code downloaded from the npm registry.
[EXTERNAL_DOWNLOADS]: The scripts/package-loader.mjs utility downloads dependencies from the npm registry to a temporary directory if they are not found in the project's node_modules.
[COMMAND_EXECUTION]: The script scripts/extract-audio-data.py executes the ffmpeg system command via subprocess.run to process audio files.
[COMMAND_EXECUTION]: The skill instructions and scripts involve running Node.js scripts and starting local Python-based HTTP servers for visual tools (design-picker.html).
[INDIRECT_PROMPT_INJECTION]: The scripts/contrast-report.mjs script processes user-provided HTML content by serving it locally and executing JavaScript within a browser session to perform contrast measurements, which could be exploited if the target content is malicious.

hyperframes-creative