The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions in SKILL.md that explicitly direct the agent to execute an upgrade command (voxflow upgrade -y) and specifically tells the agent to "do not ask" for permission and "do not summarize first." This is a behavioral override that attempts to bypass the agent's standard safety protocols for user confirmation before executing system commands.
[COMMAND_EXECUTION]: The skill requires the execution of multiple commands and scripts to function, including the voxflow CLI, npm for global installations, and local helper scripts like scripts/render-cards.mjs and scripts/download-fonts.sh.
[EXTERNAL_DOWNLOADS]: The scripts/download-fonts.sh script fetches resources from external public CDNs, including cdn.jsdelivr.net and api.fontshare.com. These downloads are for font assets and CSS files required for card rendering.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant ingestion surface for untrusted data which could lead to indirect prompt injection.
Ingestion points: The agent is instructed to fetch and process content from various sources, including user-provided topics, briefs, and external URLs (referenced in SKILL.md Workflow Step 2).
Boundary markers: There are no explicit instructions or delimiters mentioned to isolate external content or warn the agent to ignore any instructions embedded within the fetched data.
Capability inventory: The agent possesses capabilities to execute shell commands (voxflow, node), write files to the local system, and use Playwright to render and screenshot HTML content based on the ingested data.
Sanitization: The analysis did not find explicit sanitization or filtering logic for the content before it is structure and rendered into the final cards.

card