The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx @vedanth/context7 in references/cli-tools/doc-search.md to download and execute an external package at runtime. This package originates from a non-trusted source, posing a risk of executing malicious code on the host machine.
[COMMAND_EXECUTION]: SKILL.md contains numerous bash scripts that perform stack detection and codebase reconnaissance. These scripts use tools like grep, head, and jq to parse project files such as package.json, go.mod, and Cargo.toml.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests data from untrusted files to drive its logic:
Ingestion points: Reads content from spec-product_{v}.md (line 33) and various project manifest files like package.json (line 114).
Boundary markers: None are present to distinguish between trusted instructions and potentially malicious content within the ingested files.
Capability inventory: The skill possesses significant capabilities, including arbitrary shell command execution via subprocesses and the ability to trigger subagents.
Sanitization: No validation or sanitization is performed on the data extracted from project files before it is used in logic or displayed. The "Security check" on line 33 (grepping for approved: true) is a superficial check that an attacker can easily bypass by including that string in a malicious file.
[EXTERNAL_DOWNLOADS]: In references/cli-tools/stack-skills.md, the skill utilizes the skills tool from Vercel Labs' public repository to manage coding patterns. Additionally, it fetches documentation data using the unverified @vedanth/context7 utility.

stelow-product-tech-planning