The Agent Skills Directory

[DATA_EXFILTRATION]: The server is configured in scripts/server.cjs to allow access to the entire user home directory by default. While this is functional for a file browser, it creates an exposure surface for sensitive files such as SSH keys, cloud credentials, and environment secrets.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local files. In scripts/lib/text-renderer.cjs, HTML files are rendered in an iframe using allow-same-origin and allow-scripts sandbox attributes. This configuration allows a malicious HTML file to programmatically access other local files through the server's API.
Ingestion points: Reads local files provided via the ?file= query parameter (e.g., in scripts/lib/http-server.cjs).
Boundary markers: None implemented for the HTML viewer; the sandbox is weakened by the allow-same-origin attribute.
Capability inventory: File reading and directory listing capabilities provided by the server API (scripts/lib/tree-api.cjs, scripts/lib/http-server.cjs).
Sanitization: Path traversal protection is present, but content-level sanitization for HTML is bypassed by design for rendering.
[EXTERNAL_DOWNLOADS]: The scripts/generate-logo.cjs utility script makes network requests to OpenRouter's official API (openrouter.ai) to generate a project logo.

file-browser