The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the dynamic context injection pattern !bash "${CLAUDE_SKILL_DIR}/scripts/audit.sh" $ARGUMENTS in SKILL.md. This pattern executes a shell command when the skill is loaded. Because the $ARGUMENTS variable consists of user-provided input that is not sanitized before being passed to the shell, an attacker can append malicious shell commands (e.g., using ;, &&, or |) which will be executed in the user's environment before the agent interaction begins.
[PROMPT_INJECTION]: The skill implements an audit workflow that is vulnerable to indirect prompt injection. It fetches issue descriptions and comments from the Paperclip API, encodes them into Base64 (in scripts/check-task-hygiene.sh), and then explicitly instructs the LLM to decode and analyze them in SKILL.md (e.g., checking for 'Objective' or 'Definition of Done'). This data originates from external sources or other agents and could contain malicious instructions designed to manipulate the audit report or bypass safety constraints.
Ingestion points: Issue comments and task descriptions retrieved from the local Paperclip API in scripts/check-task-hygiene.sh and stored in AUDIT_TMP/discovery.json and shell output.
Boundary markers: Absent; the skill does not use specific delimiters or instructions to ignore potential commands within the decoded data.
Capability inventory: The skill uses Bash to execute multiple local scripts and curl for network requests, and the Read tool for broad file system access.
Sanitization: None; the content is passed through Base64 encoding/decoding without validation or filtering.

audit-paperclip