The Agent Skills Directory

[COMMAND_EXECUTION]: The skill generates and executes shell commands that include unvalidated user input. In analyze-target.md, the git clone command interpolates repository owner and name variables derived from user input without explicit sanitization.
[COMMAND_EXECUTION]: Multiple workflow stages (e.g., gather-intent.md, write-brief.md, scope-definition.md) use heredocs (such as SKF_TARGET, SKF_JSON, and SKF_SCOPE_PAYLOAD) to pass user-supplied content to scripts. These heredocs can be terminated by a malicious user including the delimiter in their input, leading to arbitrary shell command execution.
[DYNAMIC_EXECUTION]: The skill uses uv run to execute local Python scripts at paths determined dynamically during the workflow, such as {resolvePackageHelper} and {detectLanguageHelper}, which are resolved based on project structure.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing external repository content, manifests, and documentation. This creates a significant surface for indirect prompt injection, where malicious instructions hidden in the analyzed codebase could manipulate the agent's behavior during brief generation.
[PERSISTENCE]: The customize.toml configuration allows for an on_complete shell command to be defined. This command is executed automatically every time a skill brief is successfully written, providing a vector for persistent code execution.
[EXTERNAL_DOWNLOADS]: The skill performs git clone operations on remote repositories provided by the user to facilitate local code analysis.

skf-brief-skill