The Agent Skills Directory

[COMMAND_EXECUTION]: Command Injection vulnerability in the setup phase. The logic in phases/01-setup.md constructs a Bash command to backup skill files using direct string interpolation of variables (skill.path, skill.name) derived from the $ARGUMENTS input. A user providing a skill path containing a double quote (e.g., my-skill"; rm -rf /; ") can break out of the intended command string and execute arbitrary shell instructions.
[COMMAND_EXECUTION]: Insecure shell escaping implementation. The escapeForShell function used in phases/02-execute.md and phases/03-evaluate.md only escapes double quotes, dollar signs, and backticks. It fails to account for other dangerous shell metacharacters such as single quotes, semicolons, or pipes, which may still allow for injection depending on the specific shell environment and input context.
[PROMPT_INJECTION]: Indirect Prompt Injection risk in the automated tuning pipeline. The skill reads content from potentially untrusted third-party skill files and passes them to an LLM for evaluation, then subsequently passes that evaluation to an autonomous agent to apply changes. A malicious skill can embed instructions designed to manipulate the evaluator's output, tricking the improvement agent into performing harmful actions such as injecting backdoors or executing unintended tools.
Ingestion points: Content from skill files (e.g., SKILL.md, phases/*.md) read during Phase 2 and 3.
Boundary markers: The skill content is delimited by simple markdown headers without robust isolation or 'ignore embedded instructions' warnings.
Capability inventory: The skill utilizes powerful tools including Bash, Agent, Write, and Edit.
Sanitization: There is no validation or sanitization of the LLM-generated suggestions before they are acted upon by the autonomous agent in Phase 4.

skill-iter-tune