The Agent Skills Directory

[DATA_EXFILTRATION]: The skill reads from and writes to the global /tmp/bughunt-output/ directory for 'prior-run memory'. Accessing shared global temporary space allows for potential data poisoning by other users or processes and could be exploited via symbolic link attacks to read or write files outside the intended project scope.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted codebase content and historical reports which are then processed by autonomous subagents. These subagents have the capability to generate code edits and trigger shell commands (linters) without explicit boundary markers or sanitization steps to prevent malicious instructions embedded in the target code from influencing behavior.
Ingestion points: Target files identified in the 'Orient' phase; prior reports read from the global /tmp/bughunt-output/ directory (SKILL.md).
Boundary markers: None identified; subagent prompts interpolate raw file content and finding descriptions without delimiters.
Capability inventory: mkdir -p command execution; Edit tool for codebase modification; bash -n, python -m py_compile, and tsc --noEmit shell execution on modified files (SKILL.md).
Sanitization: None; raw file content is passed directly to subagents for reasoning.
[COMMAND_EXECUTION]: The skill executes shell commands for environment setup and file verification. While these commands (mkdir, bash, python, tsc) are standard, they are performed autonomously on code generated by subagents without user review or approval.
[DYNAMIC_EXECUTION]: In the 'Audit' phase, the skill executes syntax and parse checks on modified files. If a subagent is compromised via indirect injection, it could generate code designed to exploit the linter or the shell environment during this automated execution phase.

bughunt