The Agent Skills Directory

[COMMAND_EXECUTION]: Command injection vulnerability in the search query instruction.
The skill's instructions provide a template eval "$(python scripts/extract-search-results.py '{keyword}' --filter {filter})" which is intended to be executed using a shell tool.
Because the {keyword} parameter is sourced from user input and interpolated directly into a bash command, an attacker can provide search terms containing shell metacharacters (e.g., $(...) or backticks) to execute arbitrary commands on the host system.
[COMMAND_EXECUTION]: Unsafe dynamic code execution pattern.
The skill uses a pattern where a Python script generates Javascript code at runtime, which is then executed via shell eval. This multi-layered execution of dynamically generated code is highly susceptible to injection attacks and bypasses standard input validation.
[PROMPT_INJECTION]: Indirect prompt injection surface through the ingestion of external Threads content.
Ingestion points: The skill extracts search results directly from the document.documentElement.innerHTML of Threads search pages via the scripts/extract-search-results.py script.
Boundary markers: There are no boundary markers or instructions to the agent to treat the extracted content as untrusted data.
Capability inventory: The agent environment has access to powerful tools including browser-act and bash, which increases the risk of successful exploitation if malicious instructions are found in the scraped data.
Sanitization: The extraction logic lacks any sanitization or filtering of the text and username fields, allowing external content to be placed directly into the agent's context.

threads-keyword-search