The Agent Skills Directory

[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The script scripts/package-loader.mjs implements a custom dependency bootstrapping mechanism. It executes npm install to download Node.js packages (such as @hyperframes/producer and sharp) from the public npm registry at runtime if they are not already available. While it includes defensive measures like pinning versions and using the --ignore-scripts flag to prevent the execution of malicious install scripts, this pattern bypasses standard build-time dependency management and enables the execution of code fetched from the internet.
[DYNAMIC_EXECUTION]: The scripts/package-loader.mjs script uses the dynamic import() function to load modules from file paths resolved at runtime, specifically from temporary directories created during the bootstrap process. This facilitates the execution of dynamically downloaded or generated code.
[INDIRECT_PROMPT_INJECTION]: The design picker mechanism described in templates/design-picker.html and references/design-picker.md creates an attack surface where LLM-generated HTML (preview_html) is injected into a local UI using innerHTML.
Ingestion points: templates/design-picker.html via the __ARCHITECTURES_JSON__ placeholder.
Boundary markers: Absent. Generated content is interpolated directly into the document structure.
Capability inventory: Execution of arbitrary HTML, CSS, and potentially client-side JavaScript in the user's browser context.
Sanitization: Absent; the skill relies on instructional warnings to the agent (e.g., in references/design-picker.md) to avoid including <script> tags or event handlers, which does not provide programmatic protection against malicious generation.
[DATA_EXPOSURE_AND_EXFILTRATION]: Instructions in references/design-picker.md direct the agent to launch a local HTTP server using python3 -m http.server 8723. Although intended to serve a generated file for local user interaction, starting a network listener based on agent-supplied parameters is a behavior that could be repurposed for unauthorized data access or exfiltration.
[DYNAMIC_EXECUTION]: scripts/extract-audio-data.py executes the ffmpeg command via subprocess.run to process audio files. scripts/package-loader.mjs also uses spawnSync to execute the npm CLI for dependency installation. Spawning external processes increases the risk of command injection if input parameters are not strictly validated.

hyperframes-creative