The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to verify CLI flag documentation by executing scripts from the target repository (e.g., python scripts/foo.py --help). This creates a significant security risk because scripts often execute arbitrary code during module initialization or argument parsing, even when help flags are used. If the repository being audited is malicious, this results in local code execution.
[REMOTE_CODE_EXECUTION]: The verification workflow involves running executable files found within the untrusted repository. This facilitates the execution of potentially malicious code from an external source within the local environment.
[DATA_EXFILTRATION]: The skill directs the agent to identify and verify environment variables and configuration defaults. While the instructions suggest checking .env.example, the requirement to verify these claims against 'actual codebase' usage and 'config modules' encourages the agent to inspect sensitive configuration files, creating a risk of credential exposure if real .env files or active environment secrets are present.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted markdown files to extract 'claims' without sanitization or boundary markers.
Ingestion points: Documentation files and README.md (via SKILL.md and checklist.md).
Boundary markers: Absent; no instructions are provided to the agent to disregard instructions embedded in the documentation files.
Capability inventory: Includes shell command execution (grep, ls) and Python script execution.
Sanitization: Absent; claims are extracted verbatim and used to drive verification actions.
[PROMPT_INJECTION]: The inclusion of a skill-report.json file containing a pre-existing, conflicting security analysis indicates an attempt at metadata poisoning. This file attempts to front-run and dismiss potential findings, which is characteristic of attempts to mislead or confuse automated security review processes. Additionally, the skill author metadata ('2389-research') in the files conflicts with the registered vendor ('aiskillstore'), further suggesting an untrusted or inconsistent supply chain.

documentation-audit