The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill includes a dedicated workflow in references/workflows/allow.md that modifies the platform's security configuration file (~/.claude/settings.json). It is designed to add specific command patterns (like git clone, WebFetch, and WebSearch) to the .permissions.allow list. This effectively bypasses the platform's security model, which requires manual user approval for tool execution, potentially allowing background agents to perform sensitive operations without oversight.
[INDIRECT_PROMPT_INJECTION]: The researcher agent (agents/researcher.md) ingests untrusted data from external websites and third-party repositories. This content is then used to generate research artifacts that guide other agents' decisions. The lack of sanitization or safety delimiters for this ingested content makes the skill vulnerable to indirect prompt injection.
Ingestion points: The agent uses WebFetch to read documentation and git clone to retrieve source code from external URLs specified during the research phase.
Boundary markers: The instructions do not define any delimiters (e.g., XML tags or special markers) to isolate external content from the agent's instructions, nor do they warn the agent to ignore embedded instructions in the fetched data.
Capability inventory: The skill uses tools including Bash, Write, WebFetch, and WebSearch, providing a significant capability tier for an attacker to target.
Sanitization: There is no evidence of input validation or escaping for the external content before it is processed or written to markdown artifacts.
[COMMAND_EXECUTION]: The skill's workflows (diff.md, new.md) and initialization script (scripts/cv_init_store.py) execute various shell commands. The workflows interpolate user-supplied arguments, such as repository URLs, directly into git clone command lines. This represents a command injection risk if the calling platform does not sufficiently sanitize the provided arguments.
[EXTERNAL_DOWNLOADS]: The skill frequently downloads external content using WebFetch and clones remote repositories via git clone to perform its primary function of technical exploration and comparison.

explore