The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill defines a workflow where the agent 'develops' code by editing files that are subsequently processed by build tools. This creates a vulnerability where malicious instructions embedded in external data (e.g., a website the agent is analyzing to build an artifact) could be injected into the React source or package.json.
Ingestion points: Source files in the src/ directory and project configuration files like package.json and index.html.
Boundary markers: None identified; instructions do not advise the agent to sanitize or ignore instructions within the generated code.
Capability inventory: The skill uses the Bash tool to run npm install and npx parcel build, which can trigger lifecycle scripts or execute malicious code within the build pipeline.
Sanitization: None provided for the generated code before it is passed to the build tools.
[Unverifiable Dependencies] (MEDIUM): The bundle-artifact.sh script automatically installs several npm packages (parcel, html-inline, etc.) if they are missing. These dependencies are fetched from a public registry without version pinning, posing a supply-chain risk.
[Remote Code Execution] (MEDIUM): The skill uses npx to execute downloaded packages (parcel and html-inline). Executing unverified code from a remote registry at runtime is a dangerous pattern in an agentic context.
[Command Execution] (LOW): The skill relies on the Bash tool to execute internal scripts (init-artifact.sh, bundle-artifact.sh). While the scripts themselves appear functional, the reliance on shell execution for the build process increases the impact of any injection vulnerabilities.

artifacts-builder