The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the !command`` syntax in SKILL.md to execute shell commands at load time, which presents a command injection risk.
The instruction !taskmarket task get $0`` passes the positional argument $0 directly into a shell command. If a user provides a malicious task ID containing shell metacharacters (e.g., ; rm -rf /), it could lead to arbitrary code execution.
The command !fetch-model-pricing ...`` is also executed automatically upon loading the skill, increasing the attack surface for shell-based exploits.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data (TaskMarket tasks) which can influence agent behavior.
Ingestion points: User-supplied $ARGUMENTS and the output of the taskmarket task get $0 command are directly incorporated into the agent's context in SKILL.md.
Boundary markers: Absent. There are no delimiters or "ignore embedded instructions" warnings used when the skill reads the task scope or snapshot.
Capability inventory: The skill possesses the capability to execute shell commands (taskmarket, fetch-model-pricing) and perform network lookups.
Sanitization: Absent. No validation or sanitization is performed on the task content before it is used to drive the estimation logic.
[COMMAND_EXECUTION]: The skill's primary logic depends on executing external CLI utilities (taskmarket, fetch-model-pricing). While these appear to be vendor-specific tools from daydreamsai, their use in combination with unvalidated arguments creates an exploitable execution path.

task-estimator