The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to shell command injection. In the fallback tracing step, the user-supplied function_name is interpolated directly into rg (ripgrep) and grep commands without any sanitization. An attacker providing a function name containing shell metacharacters (e.g., "; rm -rf / #") could execute arbitrary commands on the system.
[DYNAMIC_EXECUTION]: The skill uses a dynamic path resolution pattern to find and execute a Python script. It uses the find command to locate graph_query.py within the ~/.claude/plugins directory and stores the result in a variable (GRAPH_QUERY) which is subsequently executed using python3. Executing scripts from computed paths introduces a risk of running unintended or modified files if the search criteria are too broad or the directory is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill processes source code files to build call trees and displays the results (file content and matches) to the agent. This represents an indirect prompt injection surface where malicious instructions embedded in the analyzed code (e.g., in comments or docstrings) could influence the agent's behavior.
Ingestion points: Local source code files (via rg, grep, or the gauntlet plugin) and user-supplied function names.
Boundary markers: No explicit delimiters or instructions are used to distinguish analyzed code from agent commands.
Capability inventory: The skill has the capability to execute shell commands and read files from the local filesystem.
Sanitization: No sanitization or validation of the ingested code or user-provided function name is performed before execution or display.

call-chain