The Agent Skills Directory

[COMMAND_EXECUTION]: Direct shell command injection vulnerability in phases/01-load-manifest.md. The variable ${PACKAGE_PATH} is interpolated directly into a Bash block (package_path="${PACKAGE_PATH}") without escaping or sanitization, allowing arbitrary command execution if the path contains shell metacharacters like ; or &.
[COMMAND_EXECUTION]: Multiple command injection vulnerabilities in phases/03-generate-specs.md. Fields extracted from the JSON manifest (such as spec.title, spec.body, spec.keywords, and spec.category) are interpolated into Bash() tool calls for grep and the maestro spec add command. An attacker providing a malicious manifest can escape the quoting to execute arbitrary code (e.g., setting a title to "; touch /tmp/pwned #).
[COMMAND_EXECUTION]: Potential command injection in phases/04-index-verify.md. The variables ${knowhowPaths} and ${slug} are used in shell loops and grep commands without proper sanitization, which could be exploited if the manifest contains malicious strings.
[PROMPT_INJECTION]: Indirect prompt injection surface identified. The skill processes external data from knowhow-manifest.json and uses it to drive its execution logic and content generation.
Ingestion points: Reads knowhow-manifest.json from the path specified by the user/system in phases/01-load-manifest.md.
Boundary markers: None identified. Data is parsed and used directly.
Capability inventory: The skill uses Bash, Write, and Edit tools to perform file system operations and execute CLI tools based on the manifest data.
Sanitization: No evidence of input validation, escaping, or sanitization was found for the data loaded from the manifest before its use in shell commands or file writes.

codify-to-knowhow