The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically constructs and executes bash commands using placeholders like <pkg>, <binary>, and <VAR> which are populated from untrusted user-provided security advisories. The lack of sanitization for shell metacharacters in these inputs allows for command injection, potentially bypassing the skill's own safety constraints (e.g., read-only and no network rules).
[DATA_EXFILTRATION]: The skill instructions direct the agent to read sensitive shell configuration files, specifically ~/.zshrc and ~/.zprofile. These files are high-value targets as they frequently contain hardcoded secrets, authentication tokens, and API keys, leading to sensitive data exposure within the agent context.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data (security advisories) and uses it to drive internal logic and command generation without boundary markers or validation.
Ingestion points: Security advisories provided by the user (SKILL.md).
Boundary markers: None identified; external advisory text is treated as authoritative for variable extraction.
Capability inventory: Extensive file system search (find), process inspection (pgrep, lsof), environment variable access (launchctl), and file writing to ~/audits/ (SKILL.md).
Sanitization: None identified; inputs are interpolated directly into shell command templates.

cyber-audit