The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains logic that executes shell commands using string interpolation of variables, which is a high-risk pattern for command injection.
Evidence in SKILL.md: The git_bisect_automated function in Python uses subprocess.run(cmd, shell=True) where cmd is built from variables like bad_commit and test_command without sanitization or escaping.
Evidence in SKILL.md: The Bash script bisect.sh uses sh -c "$TEST_CMD", allowing for arbitrary command execution controlled by the variable value.
[REMOTE_CODE_EXECUTION]: The pattern of executing a user-provided or context-derived test_command within a shell environment constitutes a significant risk of arbitrary code execution on the host system.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface because it is designed to ingest and process external, potentially untrusted data.
Ingestion points: Functions such as LogCorrelator.parse_log_file and parse_python_traceback in SKILL.md read and parse data from external files and logs.
Boundary markers: There are no boundary markers or instructions to the agent to distinguish between legitimate data and potential instructions embedded within the logs or traces.
Capability inventory: The skill possesses powerful capabilities, specifically shell execution via subprocess and git commands in SKILL.md.
Sanitization: The ingested data is not sanitized or validated for malicious payloads or instructions before it is processed by the agent.

bug-localization