The Agent Skills Directory

[DYNAMIC_EXECUTION]: The orchestration script full-audit.sh uses an unsafe pattern to aggregate results from sub-audits by interpolating raw shell variables into a Python command-line script.
Evidence: In scripts/full-audit.sh, the variables $image_result, $bundle_result, and $dep_result are placed inside triple single quotes (''') within a python3 -c call (lines 42, 47, and 52).
Risk: The individual audit scripts (image-audit.sh, dep-audit.sh) do not escape single quotes when reporting file paths or package names. A maliciously crafted filename containing three consecutive single quotes (e.g., audit'''import os;os.system('id')#'''.png) would terminate the Python string literal and allow for arbitrary code execution in the user's local environment.
[INDIRECT_PROMPT_INJECTION]: The skill audits untrusted project data, creating a surface for indirect prompt injection.
Ingestion points: The skill reads file system paths in scripts/image-audit.sh and scripts/bundle-audit.sh, and parses package.json in scripts/dep-audit.sh.
Boundary markers: The skill does not employ delimiters or specific instructions to the agent to treat the audited data as untrusted or to ignore embedded instructions.
Capability inventory: The skill possesses capabilities for file system traversal and command execution via shell and Python.
Sanitization: The skill lacks mechanisms to sanitize audited content against malicious instructions before the data is returned to the agent context.

perf-audit