The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's instructions include shell script blocks that incorporate user input via {{user_text}} and {{user_path}} placeholders into variable assignments (e.g., TEXT="{{user_text}}"). If the input contains shell-special characters such as backticks, semicolons, or command substitutions, it could lead to arbitrary command execution on the host system.
[DATA_EXFILTRATION]: The commands /deepl file and /deepl xliff allow the agent to access files based on a user-provided path and upload their contents to the DeepL API for translation. The skill lacks path validation or restriction, which could be exploited to read and exfiltrate sensitive files (such as .env files or SSH keys) to the external API.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external files and API responses. There is a risk of indirect prompt injection as the evidence chain shows:
Ingestion points: User-supplied text and file paths in SKILL.md.
Boundary markers: The skill does not implement delimiters or instructions for the agent to ignore embedded commands in the translated content.
Capability inventory: Includes file system read access, network access via curl, and shell execution capabilities.
Sanitization: While curl uses url-encoding for the API request, the initial handling of the data in shell scripts lacks escaping, and the resulting translation is returned to the agent without filtering.

deepl