The Agent Skills Directory

[OBFUSCATION]: The script scripts/curl.sh uses Base64 encoding to hide the target domain name. While the decoded domain (weather.com.cn) belongs to a legitimate service, the use of encoding is a common technique for bypassing simple static analysis filters.
Evidence: DOMAIN=$(echo "d2VhdGhlci5jb20uY24=" | base64 -d) decodes to weather.com.cn.
[COMMAND_EXECUTION]: The skill uses a helper script that functions as a transparent wrapper for the curl command-line tool. It passes all provided arguments directly to the shell, enabling unrestricted network requests with arbitrary flags.
Evidence: The script scripts/curl.sh uses "$@" to execute curl with all passed parameters, including those that define the target URL and request method.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to argument injection because the curl wrapper script does not sanitize its inputs. If an attacker can influence the city names or IDs processed by the agent, they could potentially inject curl flags such as -d @/etc/passwd or -o to read sensitive local files or overwrite local data.
Ingestion points: City search names and city ID parameters defined in the SKILL.md command templates.
Boundary markers: None present to instruct the agent to ignore malicious formatting in input data.
Capability inventory: The skill has the capability to perform arbitrary network operations and read files via curl flags.
Sanitization: No input validation or escaping is performed on the arguments before they are passed to the shell.

tianqi