The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interacts with a local CLI tool /opt/hatch/bin/feature-request. Instructions specifically direct the agent to wrap --summary and --context arguments in single quotes to prevent Bash variable expansion (e.g., $650). This approach is vulnerable to shell command injection; an attacker could provide feedback containing a single quote (e.g., '; malicious_command; ') to terminate the intended argument and execute arbitrary commands.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input and passes it to an external system command, creating an injection surface.
Ingestion points: User-provided feedback and conversation history (SKILL.md).
Boundary markers: The agent is instructed to use single quotes as delimiters for CLI arguments, but these do not safely handle nested quotes.
Capability inventory: The skill can execute feature-request with draft, file, show, list, and delete subcommands.
Sanitization: The agent is instructed to summarize feedback and remove private data (names, contact details) before filing, which provides some natural language sanitization but does not address technical command injection.
[PROMPT_INJECTION]: The skill contains instructions to suppress certain outputs from the user, such as raw command output and internal field names (slugs). While this is intended for user experience (UX), it limits the user's ability to verify the exact data being sent to the CLI. This risk is partially mitigated by a mandatory step requiring the agent to present a draft summary for explicit user approval before final filing.

muse-feedback