The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/easel_api.ts uses the import() function to dynamically load the source code of the EASEL.js library for runtime inspection. Similarly, scripts/smoke_entry.ts executes application entry points to verify rendering behavior. This allows for the execution of arbitrary logic contained within the project files.
[COMMAND_EXECUTION]: The skill employs Bun.spawnSync and shell scripts to run development tools such as tsc and bun. Specifically, assets/examples/verify.sh automates environment setup, file management, and test execution.
[EXTERNAL_DOWNLOADS]: The assets/examples/verify.sh script performs dependency installation using bun install, which fetches packages from external registries. While these are typically used for template verification, it represents an external data ingestion point.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because its tools (easel_api.ts, smoke_entry.ts) ingest and execute code from the project being audited without sanitization or sandboxing.
Ingestion points: Library source (src/index.ts) and application entry modules are loaded via import() in easel_api.ts and smoke_entry.ts.
Boundary markers: The skill does not implement isolation, sandboxing, or delimiters when executing code from the workspace.
Capability inventory: The environment allows file system access, command execution, and network access (via package managers).
Sanitization: No validation or filtering is performed on the ingested code prior to its dynamic execution.

using-easeljs