The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses execSync to run a headless Chrome process for image generation. The output file path (cardPath) is constructed using the outputDir parameter without sanitization against shell metacharacters. If an attacker can control or influence the output directory name, they could inject arbitrary shell commands. \n
Evidence: execSync(\""${chromeBin}" --headless=new ... --screenshot="${cardPath}" ...")ingenerate.shwherecardPathis derived from the unsanitizedoutputDir.\n- **[DYNAMIC_EXECUTION]:** The generate.shscript executes a multi-line Node.js script by piping its content directly into thenode` process via standard input. This pattern of dynamic code execution can be used to hide malicious logic and complicates static security analysis.\n
Evidence: `node
"$QUOTES_JSON" "$BASE_DIR" "$CHROME" <<'NODE_SCRIPT'ingenerate.sh.\n- **[INDIRECT_PROMPT_INJECTION]:** The skill ingests untrusted data from hooks.json` or user-provided quote files and interpolates it into an HTML template. The lack of strict schema validation and reliance on simple HTML escaping creates a surface for indirect prompt injection if the generated output is subsequently processed by an AI agent.\n
Ingestion points: index.js reads from options.quotes or outputDir/hooks.json.\n
Boundary markers: No delimiters or instructions to ignore embedded commands are present in the prompt interpolation logic.\n
Capability inventory: The skill has access to the Bash tool and performs shell execution via execSync.\n
Sanitization: Basic HTML character escaping is implemented, but no validation is performed on the content length or structure of the ingested data.

cover