The Agent Skills Directory

[COMMAND_EXECUTION]: The validation scripts (scripts/validate_all.cjs and scripts/lint_style.cjs) use child_process.execSync to execute shell commands by concatenating the input draft path into a command string. Although the path is wrapped in double quotes, it is not properly escaped for shell metacharacters. This allows arbitrary command execution if a draft file is named using shell expansion syntax (e.g., $(id).md).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (technical blog drafts) and lacks robust delimiters or sanitization to prevent embedded instructions from hijacking the agent's task logic. ● Ingestion points: Blog draft files read by the agent and validation scripts. ● Boundary markers: No explicit markers or 'ignore' instructions are used to wrap the processed draft content. ● Capability inventory: The skill can execute local scripts via execSync, access the file system, and use the agent's toolset. ● Sanitization: While scripts/sanitize_blog.cjs checks for hardcoded credentials, it does not filter or sanitize the draft content for prompt injection markers.

google-blog-style