The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/auto_generate_demo.py and scripts/record_interactive.sh scripts facilitate the execution of arbitrary shell commands within a terminal recording environment via the vhs utility. While this is the intended purpose of the skill, it provides a powerful capability that can be abused to run dangerous commands on the host system.
[OBFUSCATION]: The skill documentation in SKILL.md and references/advanced_patterns.md explicitly promotes using Base64 encoding as a workaround for VHS parser limitations. This technique allows for the execution of complex shell scripts, including functions and redirects, that are not directly visible in the tape file text, potentially hiding malicious intent from simple inspection.
[COMMAND_EXECUTION]: The script scripts/record_interactive.sh is vulnerable to shell command injection. It uses an unquoted here-document (<< EOF) to generate configuration files, which causes the shell to evaluate and execute any command substitution sequences (e.g., $(...) or backticks) contained within the $OUTPUT or $CAST_FILE variables at runtime.
[DYNAMIC_EXECUTION]: The Python script scripts/auto_generate_demo.py dynamically constructs .tape scripts from user-provided command strings and executes them using subprocess.run. There is no validation or sanitization of the input commands before they are written to the executable script file.
[INDIRECT_PROMPT_INJECTION]: The skill exposes a significant attack surface for indirect prompt injection by processing untrusted data (CLI commands) and executing them with full shell capabilities.
Ingestion points: Command-line arguments -c, --bootstrap, and --filter in auto_generate_demo.py, and YAML configuration files in batch_generate.py.
Boundary markers: None identified. Instructions are directly interpolated into the execution context.
Capability inventory: Full shell access through the vhs recording environment, file system operations (cp, rm, sed), and subprocess management.
Sanitization: None. The scripts do not escape or validate the provided shell commands before execution.

cli-demo-generator