The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents a pattern where markdown content from project-local files (.claude/*.local.md) is ingested and used as prompts for the AI agent.\n
Ingestion points: The agent is instructed to read content from .claude/plugin-name.local.md files within the project directory (as described in SKILL.md).\n
Boundary markers: There are no clear boundary markers or instructions to ignore embedded commands within the ingested markdown body, which is intended to be used directly as a prompt for the assistant (e.g., in references/parsing-techniques.md and references/real-world-examples.md).\n
Capability inventory: The skill utilizes shell-based parsing (sed, awk, jq) and demonstrates interaction with other terminal sessions via tmux.\n
Sanitization: While the documentation mentions using jq --arg for safe JSON construction, it does not address the risk of the agent executing instructions contained within the ingested text.\n- [COMMAND_EXECUTION]: The provided scripts and examples demonstrate unsafe shell command construction practices that could lead to command injection.\n
Evidence: SKILL.md includes a "Sanitize User Input" section that demonstrates writing to a file using a heredoc (<<EOF) with direct variable interpolation. This pattern is vulnerable to shell command execution if the input contains backticks or dollar-sign expressions (e.g., $(...)).\n
Evidence: references/parsing-techniques.md contains an example of updating settings using sed where a shell variable ($NEW_VALUE) is interpolated directly into the sed command string without sanitizing the delimiter characters (e.g., /). This allows for sed command injection if the variable content is influenced by untrusted input.\n
Evidence: references/real-world-examples.md shows a pattern using tmux send-keys to transmit variables extracted from the settings file (AGENT_NAME, TASK_NUMBER, PR_NUMBER) to another terminal session. If these values are maliciously crafted and the target session is a shell, it results in arbitrary command execution.\n- [DYNAMIC_EXECUTION]: The skill encourages the dynamic assembly of shell commands and JSON payloads based on content parsed from local configuration files at runtime.\n
Evidence: The parsing logic in scripts/parse-frontmatter.sh and the examples in references/parsing-techniques.md rely on string manipulation to build commands that execute against user-editable files, creating a surface for injection attacks if input validation is bypassed.

plugin-settings