The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input in the form of seed keywords and app descriptions which are then interpolated into shell commands.
Ingestion points: User-provided seed keywords and descriptions are used as positional arguments in the aso keywords analyze and aso keywords recommend commands in SKILL.md.
Boundary markers: The instructions do not define delimiters or provide specific instructions to the agent to escape shell-sensitive characters (e.g., semicolons, backticks, or pipes) in user input.
Capability inventory: The skill has the capability to execute shell commands via the aso CLI tool.
Sanitization: There is no mention of sanitizing or validating the input data before it is passed to the shell environment.
[COMMAND_EXECUTION]: The skill relies on executing shell commands (aso keywords analyze <seed1> <seed2> ...) to perform its primary function. While these are intended tool invocations, the pattern of using unquoted and unsanitized user-supplied strings as command arguments creates a vulnerability surface for command injection if the agent does not apply its own implicit safety filters.

keyword-research