The Agent Skills Directory

[COMMAND_EXECUTION]: The generate.sh script executes several system commands including node, jq, and weasyprint to process data and generate PDF output.
[DATA_EXFILTRATION]: The script allows the reading of arbitrary local files if a path is provided as the first argument to the generation command. Additionally, because the tool uses weasyprint to render HTML into a PDF, it is potentially vulnerable to Local File Inclusion (LFI). If the input JSON data contains malicious HTML tags (such as <link> or <img> tags referencing file:// URIs), the resulting PDF could contain sensitive local file contents.
[REMOTE_CODE_EXECUTION]: The skill uses a shell 'heredoc' to pipe a JavaScript snippet directly into the node interpreter. This pattern of generating and executing code at runtime, while static in this implementation, is a vector for executing arbitrary logic.

invoice-generator