The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to interpret and execute natural language instructions embedded within specific markers (start-shorthand, end-shorthand). This allows external data to override agent behavior if the agent processes untrusted files containing these markers.
[COMMAND_EXECUTION]: The instructions explicitly authorize the agent to execute shell commands if requested via the shorthand notation. Specifically, the 'Non-Code Actions' section states: 'Execute the requested action (run commands, create files, fetch data) and remove shorthand'. This bypasses standard safety review if the agent interprets shorthand from an untrusted source.
[DATA_EXFILTRATION]: The skill enables network operations via shorthand requests, such as 'fetch current weather from API' or 'fetch data'. An attacker could use this to exfiltrate local files or environment variables by embedding malicious shorthand in a repository.
[PROMPT_INJECTION]: The 'Compensation Rules' instruct the agent to prioritize the 'goal over the method' and to 'compensate for terminology errors'. This encourages the agent to use its own judgment to find 'better' ways to execute requests, which could lead to the agent selecting more dangerous or less restricted execution methods than originally intended by the user.
[PROMPT_INJECTION]: (Indirect Prompt Injection Surface Analysis):
Ingestion points: SKILL.md and any project files containing markers like // start-shorthand or lines starting with ()=>.
Boundary markers: The skill defines start-shorthand and end-shorthand markers, but lacks instructions to sanitize or treat the content within them as untrusted.
Capability inventory: Explicitly authorizes subprocess/command execution, file system writes ('create files'), and network requests ('fetch data').
Sanitization: No sanitization or validation of the shorthand content is specified. The agent is instead told to 'Execute the requested action' and 'remove the shorthand lines' afterward, effectively hiding the injection from the final output.

quasi-coder