The Agent Skills Directory

[DATA_EXFILTRATION]: The skill recursively copies the contents of a local skill directory using cp -R "skills/$SLUG/." "$PACK_DIR/skills/$SLUG/" and pushes it to a public GitHub repository. This creates a significant risk of accidental exposure if the source directory contains sensitive information such as .env files, private keys, or internal configuration files that were not intended for publication.
[COMMAND_EXECUTION]: The skill processes user-provided input in ${var} to extract a skill slug and flags using shell commands like awk and cut. While the slug is validated with a regex, the remaining flags are parsed dynamically, which could lead to command injection if malicious shell metacharacters are included in the input and executed by the agent's shell environment.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill reads metadata and content (title, description, category, requirements, and capabilities) from local SKILL.md files located in the skills/$SLUG/ directory.
Boundary markers: The skill performs basic regex validation on the slug name and runs local validation scripts (validate-pack.sh, validate-skill-packs.mjs) before pushing data to external services.
Capability inventory: The skill possesses extensive capabilities, including creating public GitHub repositories, pushing code, opening Pull Requests on the central registry, and writing to the local filesystem and memory logs.
Sanitization: Although jq is used for manifest creation, the skill relies on sed and Python string interpolation for README updates and Pull Request descriptions. Maliciously crafted metadata in a source skill could potentially influence the behavior of the registry or mislead users who view the generated PR and repository.

pack-submit