The Agent Skills Directory

[Indirect Prompt Injection] (MEDIUM): The scripts/create-component.js script provides a significant attack surface for indirect prompt injection. If an agent uses this skill to process data from an untrusted source (e.g., a user request or external content) and maps it directly to the script arguments, it could be exploited.
Ingestion points: Command-line arguments name, type, and dir in scripts/create-component.js.
Boundary markers: None present in the script or instructions.
Capability inventory: File system write access (fs.writeFileSync) and directory creation (fs.mkdirSync).
Sanitization: Missing. The script uses path.join with raw input, which is susceptible to path traversal attacks (e.g., using ../ in the name or directory fields).
[Command Execution] (MEDIUM): The script scripts/create-component.js performs local file system modifications. While this is its intended functionality, the ability to write arbitrary code (Astro, React, Vue, Svelte) and update index files represents a capability that can be abused to contaminate a project or overwrite sensitive configuration files if the inputs are not strictly validated.
[External Downloads] (LOW): The references/testing-guide.md documentation suggests installing several third-party packages (e.g., vitest, playwright, jsdom). Per [TRUST-SCOPE-RULE], these are considered trusted sources as they belong to established ecosystems (npm/Astro), but they still represent external dependencies that a user would need to verify manually.

astro-developer