The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions in SKILL.md prompt the agent to offer to install a third-party Node.js package '@plannotator/tot' from the NPM registry. This package originates from an unverified organization not listed among the trusted vendors.
[REMOTE_CODE_EXECUTION]: By installing and running a global npm package (@plannotator/tot), the skill executes external code on the user's system. This tool is used to process and publish local HTML files.
[COMMAND_EXECUTION]: The skill uses the system shell to execute the 'tot' command provided by the external package to publish the generated artifacts.
[DATA_EXFILTRATION]: The skill uses the 'tot' tool to upload local HTML artifacts to 'tot.page'. Although it mandates explicit user consent, this action transmits local data to an external, non-whitelisted service where it becomes publicly accessible to anyone with the link.
[INDIRECT_PROMPT_INJECTION]: The skill is instructed to search for and read design-related project files such as 'AGENTS.md', 'CLAUDE.md', 'DESIGN.md', 'QUALITY.md', and 'PRODUCT.md'. This creates a vulnerability surface where malicious instructions embedded in these project files (which could be controlled by external contributors) might influence the agent's output, such as by injecting malicious scripts into the generated HTML artifacts.
[INDIRECT_PROMPT_INJECTION_EVIDENCE_CHAIN]:
Ingestion points: SKILL.md (searches for and reads AGENTS.md, CLAUDE.md, DESIGN.md, QUALITY.md, PRODUCT.md)
Boundary markers: Absent (instructions do not specify how to handle embedded commands within these files)
Capability inventory: Shell execution (npm, tot), file reading/writing (generating HTML)
Sanitization: Absent

effective-design-artifact