The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform a mechanical overlap check in Step 0.5. It constructs a shell command by directly interpolating unvalidated strings derived from the asset under evaluation (e.g., PROPOSED_FULL_NAME and FULL_TRIGGER_PHRASE) into a grep command. Since these strings are placed inside double quotes in a bash script block, an attacker can utilize command substitution syntax such as $(...) or subshells to execute arbitrary commands on the host system.\n- [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by ingesting and processing untrusted asset content to evaluate routing criteria.\n
Ingestion points: Asset content is read via the Read tool, and descriptions are parsed in Step 0.\n
Boundary markers: None; the instructions do not provide delimiters or specific guidelines for the agent to ignore instructions embedded within the analyzed content.\n
Capability inventory: Access to Bash, Read, Grep, and Glob tools.\n
Sanitization: The content is processed without prior sanitization or validation before being used in evaluation and shell command construction.\n- [DATA_EXFILTRATION]: In Step 0, the skill requests a file path from the user and passes it directly to the Read tool without any path validation or restriction. This allows the agent to be manipulated into reading sensitive system files (e.g., SSH keys or environment variables) if provided with the appropriate path.

asset-placement-gate