The Agent Skills Directory

[COMMAND_EXECUTION]: Potential shell command injection vulnerability during the page ranking step.
Evidence: Step 1 instructs the agent to execute a shell command using the following template: python3 ${CLAUDE_PLUGIN_ROOT}/scripts/wiki-grounding.py rank --wiki-root <wiki_path> --question "<question>".
Risk: The user-supplied <question> is directly interpolated into a bash command string within double quotes. If the question contains shell metacharacters such as backticks, $(...), or semicolons, it could enable arbitrary command execution on the underlying system.
[PROMPT_INJECTION]: Vulnerability to indirect prompt injection from processed wiki content.
Ingestion points: The skill reads up to 12 pages from a wiki via the Read tool in Step 2.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the wiki content during the synthesis phase.
Capability inventory: The skill has access to powerful tools including Bash, Write, Read, and Glob as defined in the allowed-tools metadata.
Sanitization: No sanitization or escaping of the wiki content is performed before the model processes it to synthesize an answer.
Risk: If wiki pages contain adversarial instructions, the agent may follow them during the synthesis step, potentially leading to unauthorized tool usage or system manipulation.

knowledge-query