The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Arbitrary Python code execution is possible in Phase 1 (argument parsing). The skill interpolates the raw user input placeholder <<USER_ARGS>> directly into a triple-quoted Python string: RAW = """<<USER_ARGS>>""". An attacker can escape the string context by providing a value containing """ and append arbitrary Python code (e.g., import os; os.system(...)), which will be executed by the python3 subprocess.
[COMMAND_EXECUTION]: The skill makes extensive use of dynamically generated Python and shell scripts executed via heredocs (`python3
<<'EOF'`). This design pattern, when combined with direct interpolation of untrusted input, creates a high-risk surface for both code and command injection.
[PROMPT_INJECTION]: The skill acts as a surface for indirect prompt injection by generating executable content (plugin skeletons) based on untrusted user input.
Ingestion points: User-supplied arguments for name, description, agents, and references in Phase 1.
Boundary markers: None. Input is placed directly into template placeholders without delimiters or instructions to ignore embedded commands.
Capability inventory: The agent has access to Bash, Write, and python3, allowing generated malicious content to perform file system operations and command execution.
Sanitization: No sanitization, escaping, or schema validation is performed on the user-provided strings before they are written to the SKILL.md or plugin.json of the new scaffold.
[DATA_EXFILTRATION]: The skill stores intermediate parsing results and extracted templates in world-writable locations: /tmp/scaffold-args.json and /tmp/scaffold-templates.json. This usage of /tmp without proper permissions or unique naming exposes the skill's state and configuration to other local processes, which could lead to data exposure or symlink-based attacks.

scaffold