The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external inputs, specifically a web URL or application name (<target>), and incorporates them directly into shell commands. This creates a surface where a maliciously crafted URL or name could attempt to inject shell operators to execute unauthorized commands or influence the agent's logic.
Ingestion points: The <target> parameter in qp <target> calls, sourced from user requests.
Boundary markers: The instructions do not define delimiters or escaping mechanisms to isolate the untrusted target input from the command structure.
Capability inventory: The skill is granted Bash, Write, and Read tools, enabling it to execute scripts and modify files.
Sanitization: There is no evidence of sanitization or validation logic in the skill's instructions to verify the integrity of the target string before execution.
[COMMAND_EXECUTION]: The skill relies on executing local bash scripts (plugins/fh-qp/scripts/qp_tools.sh, scripts/cluster_capability_scan.sh, and scripts/test_fh_qp_lanes.sh) to perform core operations like target classification and adapter probing. While these are project-internal paths, the reliance on shell execution with user-controlled parameters is a notable security surface.
[DYNAMIC_EXECUTION]: The skill dynamically discovers and executes functionality by scanning for capability files in .claude/capabilities/**/*.cap and running a discovery script. This runtime resolution of executable entry points based on file system content introduces a layer of dynamic behavior that should be monitored for unexpected modifications to the local environment.

qp