The Agent Skills Directory

[COMMAND_EXECUTION]: In references/report.md, the workflow instructions direct the agent to execute a shell command using command substitution to include file contents: uv run {resultContextScript} ... --warning "$(cat "{run_dir}/resolver-warning.txt")". The contents of the file are derived from the error output of an external script. If this output contains shell metacharacters (like backticks or semicolons), they will be evaluated and executed by the shell, leading to potential command injection.
[DYNAMIC_EXECUTION]: Multiple scripts, including aggregate-coherence.py, build-result-context.py, and load-coverage-inputs.py, use Python's importlib.util to dynamically load sibling scripts from the filesystem at runtime. This practice allows code execution based on file paths rather than fixed imports.
[INDIRECT_PROMPT_INJECTION]: The skill's architecture involves ingesting data from potentially untrusted sources, such as local source code and subagent responses. Because the skill has broad permissions to run shell commands and access the network, a malicious instruction embedded in a source file or subagent output could potentially be executed if the verification logic is bypassed.
[EXTERNAL_DOWNLOADS]: The references/external-validators.md file uses npx skill-check, which may download software from the NPM registry. The skill also integrates with tessl.io for automated reviews, which involves uploading skill content to an external third-party service.

skf-test-skill