The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from multiple local sources to build its visualization, which could include untrusted content. * Ingestion points: Scans directory structures (e.g., ~/Coding/skills/), reads documentation files (BUSINESS_CONTEXT.md, README.md), and accesses recent chat history. * Boundary markers: The instructions do not define delimiters or provide warnings to ignore malicious instructions embedded in the source data. * Capability inventory: The skill performs extensive file system reads and writes new HTML and Markdown artifacts. * Sanitization: Content is embedded directly into the HTML/JS diagram structure without explicit sanitization or escaping instructions.
[DYNAMIC_EXECUTION]: The skill generates a script-heavy HTML file at runtime. It populates Javascript objects with strings retrieved from the file system. If these strings contain malicious Javascript, they may execute in the user's browser when the file is opened.
[COMMAND_EXECUTION]: To gather the necessary data, the skill is instructed to perform broad scans of the file system and task lists, which typically involves executing shell commands to list files and check process/task states.

workflow-visualizer