The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): Vulnerable command execution in references/font-management.md. Filenames retrieved via fs.readdir are interpolated directly into shell command strings without sanitization or escaping.
Evidence: await execAsync(woff2_compress ${input}); in the convertToWOFF2 function.
Evidence: await execAsync(sfnt2woff ${input}); in the convertToWOFF function.
Impact: An attacker can place a file with a name like ; touch RCE ;.ttf in the input directory to trigger arbitrary command execution when the optimization script runs.
[REMOTE_CODE_EXECUTION] (MEDIUM): The skill provides scripts intended for execution via tsx (as seen in references/best-practices.md) that contain the aforementioned command injection vulnerabilities. While the execution is local, the pattern of using child_process.exec with untrusted input is a high-risk security anti-pattern.
[EXTERNAL_DOWNLOADS] (LOW): The skill recommends installing various system binaries and npm packages from external sources.
Evidence: brew install woff2, sfnt2woff, and npm install sharp svgo mentioned in documentation.
[PROMPT_INJECTION] (LOW): Indirect prompt injection surface area exists as the skill processes filenames and directory structures which could be controlled by an attacker to influence the agent's perception of the project state.
Ingestion points: fs.readdir in references/organization.md and references/font-management.md.
Boundary markers: None identified in the provided scripts.
Capability inventory: child_process.exec, fs.rename, fs.writeFile.
Sanitization: No sanitization of filenames before they are passed to sensitive operations.

asset-manager