The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to create filesystem directories using the command 'mkdir -p ./audit-reports/{target-slug}'. The target-slug variable is derived directly from user-supplied $ARGUMENTS. This pattern creates a surface for command injection (e.g., using semicolons or backticks in the input) or directory traversal (e.g., using '../' in the argument) to write files in unauthorized locations.
[DATA_EXPOSURE]: The skill's primary function is to audit sensitive data, including PII in logs, sensitive data in URLs, and unencrypted storage. This necessitates the agent accessing and processing high-sensitivity files and configurations, which represents a significant data access surface even though it is aligned with the skill's stated purpose.

nehemiah-compliance