The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/figlet_banner.mjs attempts to load the figlet module using dynamic import() and require.resolve() from a list of computed paths. One of these paths is process.cwd(), which allows the script to load and execute code from the current working directory, posing a risk if the directory contains malicious modules.
[EXTERNAL_DOWNLOADS]: The skill requires the figlet npm package and provides instructions for its installation from the npm registry.
[COMMAND_EXECUTION]: The skill's primary functionality is delivered through the execution of a Node.js script (scripts/figlet_banner.mjs) that accepts user-provided text as command-line arguments.
[PROMPT_INJECTION]: The skill processes external text inputs which creates a surface for indirect prompt injection.
Ingestion points: Input parameters brand, slogan, and hint used by scripts/figlet_banner.mjs.
Boundary markers: No delimiters or warnings are used to differentiate untrusted data from instructions.
Capability inventory: Rendered text output is written to process.stdout and included in the agent's context.
Sanitization: The skill does not validate or sanitize the text inputs before they are rendered into the ASCII banner.

ascii-cli-logo-banner-figletjs