The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides web integration examples in references/integration-patterns.md for both Node.js (Express) and Python (FastAPI) that take user-provided data from request bodies and pass it directly to the CLI via shell-adjacent execution tools like spawn and subprocess.run. This creates a critical command injection surface for the host environment.
[REMOTE_CODE_EXECUTION]: By design, the documented integration patterns allow external network callers to control an agent with shell access and file manipulation capabilities. The examples lack authentication, input validation, or fixed tool allowlists, effectively exposing a remote execution interface to the underlying server.
[PROMPT_INJECTION]: The skill explicitly documents and encourages the use of the --permission-mode bypassPermissions flag, which disables the agent's security and approval prompts. This increases the likelihood of the agent executing malicious actions when processing untrusted data.
[PROMPT_INJECTION]: The inclusion of a fabricated security audit file (skill-report.json) represents a metadata poisoning attempt. This file contains misleading security metrics and conclusions designed to mimic legitimate audit output, which could deceive human reviewers or automated security scanners.
[PROMPT_INJECTION]: The skill exhibits high vulnerability to indirect prompt injection due to its intended use case. Ingestion points: The skill is designed to process external inputs such as pull request diffs and web API request payloads. Boundary markers: Documented prompt templates lack boundary markers or instructions to ignore embedded directives. Capability inventory: The agent is typically configured with Bash, Read, and Write tools in the provided examples. Sanitization: No sanitization, validation, or escaping of untrusted external content is implemented in any provided code snippets.

claude-code-headless