The Agent Skills Directory

[COMMAND_EXECUTION]: Shell parameter interpolation surfaces in helper scripts (arrivals.sh, trip.sh, alerts.sh). User-supplied arguments such as station names, lines, or directions are embedded directly inside JSON string bodies sent to curl. If an input contains embedded double quotes or backticks without proper sanitization, it could cause malformed JSON or alter execution parameters within complex terminal invocations, although standard variable protection helps limit complete arbitrary execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted real-time transit status details and alerts from an external API endpoint (https://subwayinfo.nyc). If a malicious user controls specific text blocks on the data-provider side or poisons transit response strings, the output returned via jq could carry instructions directed at the agent.
Ingestion points: Data enters the context via curl requests in scripts/alerts.sh, scripts/arrivals.sh, scripts/status.sh, and scripts/trip.sh processing raw output via jq -r '.content[0].text // .'.
Boundary markers: None identified in helper scripts to wrap incoming text.
Capability inventory: Uses network operations (curl) and structural parsing (jq). No explicit system file modifications or privilege changes are triggered within the helper files.
Sanitization: Relies solely on structural extraction using jq. No sanitization or safety checks are performed to strip down instructions that may be embedded within textual alert content.

subway-info