The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file instructs the agent to execute the local script scripts/generate_report.js. This script uses child_process.execSync to run the system command npm config get prefix. It also uses fs.writeFileSync to write files to locations specified by command-line arguments, which could be manipulated to overwrite local files if not properly sandboxed.
[EXTERNAL_DOWNLOADS]: The script scripts/generate_report.js relies on the external Node.js package docx. The skill does not provide a package.json file, meaning the dependency version is not locked, posing a potential supply chain risk.
[COMMAND_EXECUTION]: The reporting script dynamically modifies the module search path (module.paths.unshift) using a path derived at runtime from system command output, which is a form of dynamic execution logic.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8). It ingests untrusted advertising content into its processing pipeline without boundary markers or sanitization. Combined with its file-writing and command execution capabilities (found in scripts/generate_report.js), this allows malicious input to potentially influence the agent's report generation and file-handling behavior. Evidence includes: (1) Ingestion in SKILL.md workflow, (2) Lack of boundary markers, (3) Capability inventory includes file-writing and execSync in scripts/generate_report.js, (4) No sanitization is specified.

ad-compliance-review