The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/bootstrap.sh script is vulnerable to shell command injection. The script uses unquoted heredocs (cat << EOF) to generate configuration files while interpolating user-provided arguments such as PURPOSE, NAME, and LOCAL_DIRECTIVES. This allows arbitrary shell commands or command substitutions embedded in these strings to be executed by the host shell during the workspace generation process.
[PROMPT_INJECTION]: The skill contains an indirect prompt injection surface where untrusted data can influence agent behavior.
Ingestion points: User-provided inputs from the bootstrap process (purpose, personality, and directives) are written into core instruction files.
Capability inventory: Generated agents are granted permissions for file system operations, git management, and shell execution via the AGENTS.md protocol.
Boundary markers: No delimiters or safety warnings are present to isolate user-provided strings from the system-level instructions in SOUL.md and AGENTS.md.
Sanitization: The script performs no escaping or validation of inputs before they are interpolated into the instruction templates.
[EXTERNAL_DOWNLOADS]: The AGENTS.md template mandates the installation of the bmad-method@alpha package using npx. This instruction causes the agent to download and execute code from the public NPM registry during its operational turn.
[DATA_EXFILTRATION]: The bootstrap.sh script is designed to automatically initialize a git repository and push its content to a private GitHub repository under the author's namespace (delorenj). This represents an automated external data transfer mechanism that moves local workspace data to a remote platform.

33god-33god-agent-factory