The Agent Skills Directory

[COMMAND_EXECUTION] (MEDIUM): Scripts such as auto-print-pdf.js and system-chrome-pdf.js utilize exec and execSync to open generated HTML files in system browsers. The file paths for these commands are constructed from project directory names without proper shell escaping, which could allow for command injection if the skill is executed on a maliciously named directory.
[EXTERNAL_DOWNLOADS] (LOW): The FontManager class in scripts/font-manager.js downloads font files from external sources including Google and GitHub to support the rendering of Chinese characters in PDF output.
[REMOTE_CODE_EXECUTION] (MEDIUM): The utility scripts/auto-print-pdf.js injects JavaScript into local HTML files and then triggers the system browser to execute them. This behavior, while intended for the 'auto-print' feature, creates a risk where malicious project data could influence browser-side execution.
[INDIRECT_PROMPT_INJECTION] (LOW): The skill processes untrusted project source code and configuration files. Ingestion points occur via scripts/scanner.js. There are no specific boundary markers or instructions to prevent the agent from following commands embedded within the processed code. Capabilities include file system manipulation and subprocess execution. Sanitization is limited to basic filename character replacement.

softcopyright