The Agent Skills Directory

[COMMAND_EXECUTION]: Utility scripts located in the assets/ directory (capacity_probe.py, e2e_shard.py, impact.py, machine_lock.py) make extensive use of the subprocess module to execute system tools and user-defined command templates.
e2e_shard.py executes setup and capture commands provided as shell templates.
impact.py executes a deps_cmd string defined in a configuration file via subprocess.run(..., shell=True).
[INDIRECT_PROMPT_INJECTION]: The impact.py script is vulnerable to a form of local command injection. It identifies "suites" by parsing filenames in the project's golden scenario directory and then interpolates these names into the {suite} placeholder within the shell-executed deps_cmd without using shlex.quote() or similar sanitization.
If an attacker provides a project containing a file named like suite;malicious_command;__scenario.json, the malicious command would be executed when the impact tool is run.
[DYNAMIC_EXECUTION]: The skill facilitates the execution of arbitrary shell commands through its sharding and impact analysis tools. While these are necessary for the primary function of the skill (migrating and testing code), they represent a dynamic execution surface that processes project-specific data (filenames and command templates).
[DATA_EXPOSURE]: The self-discovery logic provided in SKILL.md uses a find command that scans broad, potentially sensitive directories including ~/.claude, ~/.config, and ~/.agents to locate the skill's base directory. While the intent is functional (locating bundled assets), this involves unauthorized directory traversal across sensitive configuration folders.

ai-migration-operating-model