The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's runner (scripts/runner.py) executes setup commands that are dynamically generated by an LLM based on user-provided input files. Although the skill uses a whitelist of allowed commands, this list includes pip, pip3, and npm. These package managers are capable of executing arbitrary code via installation scripts, which an attacker could exploit by manipulating the input file to influence the generated setup instructions.
[INDIRECT_PROMPT_INJECTION]: The skill processes external files (skills or rules) provided by the user and incorporates their content into LLM prompts without sanitization. This presents an indirect prompt injection surface.
Ingestion points: scripts/spec_generator.py and scripts/scenario_generator.py read the user-specified file.
Boundary markers: The skill uses simple --- delimiters to separate untrusted content, which is insufficient to prevent instruction injection.
Capability inventory: The skill can execute shell commands via subprocess.run (including pip and npm) and run interactive agent sessions via claude -p.
Sanitization: No input validation or content sanitization is applied to the ingested text before interpolation into prompts.
[COMMAND_EXECUTION]: The skill extensively uses subprocess.run to interact with the system and manage sandboxed environments. The execution of shell-style command strings generated by an LLM in scripts/runner.py poses a risk of command injection if the generation process is compromised through malicious input files.

skill-comply