knowledge-compiler

The code is a legitimate skeleton-generation utility, but it contains a significant command-injection flaw: untrusted TITLE and AUTHOR values are interpolated into an unquoted shell heredoc. Quote the heredoc delimiter and substitute values safely, or generate SKILL.md through a language/file API with explicit escaping. Malware intent is not evident, but exploitation by a caller controlling these arguments can execute arbitrary commands.