The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/checkpoint.sh is vulnerable to a heredoc escape that allows remote command injection. The write action constructs a remote command using a heredoc (<< 'CHECKPOINT_EOF') but interpolates user-provided metadata into the command string. An attacker could provide a value (e.g., in the --task or --next parameters) containing the string CHECKPOINT_EOF followed by arbitrary shell commands, which would be executed on the remote server when the heredoc is terminated prematurely.
[INDIRECT_PROMPT_INJECTION]: The skill implements a workflow where the agent reads and executes "next steps" stored in a remote file (~/.ssh-jobs/<job_id>/checkpoint.md). This creates a vulnerability surface for indirect prompt injection.
Ingestion points: The checkpoint.md file on the remote server, retrieved via bash long-task/scripts/checkpoint.sh read.
Boundary markers: None. The content is parsed as YAML and the agent is instructed to "按checkpoint中的next_steps继续：逐步执行" (continue according to next_steps in the checkpoint: execute step by step).
Capability inventory: The skill has full shell access to the remote server via ssh-job.sh and ssh-exec.sh.
Sanitization: None. There is no validation or filtering of the next_steps content before the agent executes the instructions found therein.

ssh-dev-suite/long-task