The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local shell script (scripts/screenshot.sh) using bash. The arguments for this script, specifically the file slug and the output path, are derived from external data such as blog post titles and user input. While the instructions suggest sanitizing the slug (lowercase, hyphens), there is a risk of command injection if the agent does not strictly follow these constraints or if the output path is maliciously crafted.
[REMOTE_CODE_EXECUTION]: The scripts/screenshot.sh script invokes Chrome/Chromium with the --no-sandbox flag. Disabling the browser sandbox while rendering HTML generated from potentially untrusted external blog content is a significant security risk. A malicious payload within the blog content could exploit browser vulnerabilities to gain access to the host system.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from blog posts to determine the visual direction and title of the cover image.
Ingestion points: SKILL.md Step 1 reads external blog post content to extract metadata and titles.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the prompt interpolation steps.
Capability inventory: The skill has the capability to execute shell scripts (bash scripts/screenshot.sh) and perform file system operations (rm, mkdir).
Sanitization: While the skill mentions deriving a slug using lowercase and hyphens, it lacks robust sanitization for the full HTML generation process, allowing content from the blog post to be directly embedded in the HTML/CSS code used for rendering.

cover-image