The Agent Skills Directory

[COMMAND_EXECUTION]: The Python GitBisector class in SKILL.md uses subprocess.run with shell=True to execute the user-provided test_command. Similarly, the JavaScript version in the same file uses execSync with a string-interpolated command. These implementation patterns are highly susceptible to shell command injection if the input command string is not strictly validated.- [REMOTE_CODE_EXECUTION]: The skill automates the git bisect run process (file: SKILL.md), which involves repeatedly executing arbitrary shell commands on the local system to identify regression points. This capability allows for the execution of code on the host machine as part of the skill's standard workflow.- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. 1. Ingestion points: Untrusted data enters the agent context through git commit logs, subjects, and bodies parsed in SKILL.md. 2. Boundary markers: Absent; the skill does not use delimiters or instructions to ignore embedded content. 3. Capability inventory: The skill has the ability to execute shell commands via subprocess.run and execSync (file: SKILL.md). 4. Sanitization: Absent; no validation or escaping of ingested repository data is performed. Malicious instructions placed in commit metadata could potentially manipulate the agent's investigative logic.

regression-root-cause-analyzer