The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands like sed, grep, cat, and sort to automate the modification of repository files (e.g., CCE allocation and profile stability data).
[COMMAND_EXECUTION]: User-provided input from $ARGUMENTS is interpolated into shell command strings such as (cat ...; echo "$ARGUMENTS") | sort -u and grep "$ARGUMENTS" .... Although Phase 1 includes a validation step for the rule ID format, any bypass of this validation could allow for arbitrary command injection during the execution of fallback shell procedures.
[COMMAND_EXECUTION]: Python subprocesses are invoked via python3 -c to perform YAML and JSON schema validation. These scripts access local file paths provided as command-line arguments.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface (Category 8). It ingests untrusted rule metadata (Title, Description, Rationale) in Phase 4 and writes this content directly into rule.yml files. There is no evidence of sanitization or escaping of this external content before interpolation. This risk is present in SKILL.md (Ingestion points: Metadata fields; Boundary markers: Absent; Capability inventory: Shell and file-write; Sanitization: Absent).

create-rule