The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (cursor-agent, codex, opencode) using the raw, unmodified user request as an argument. This creates a direct command injection vulnerability. An attacker providing a request containing shell metacharacters (e.g., ;, `, $(...)) could execute arbitrary commands on the host system.
Evidence in SKILL.md: cursor-agent -p "[user's complete request]", codex exec "[user's complete request]", and opencode run "[user's complete request]".
[PRIVILEGE_ESCALATION]: The instructions explicitly direct the agent to use a high-risk flag that bypasses security controls and sandboxing mechanisms.
Evidence in SKILL.md: The command for codex includes the flag --dangerously-bypass-approvals-and-sandbox.
[INDIRECT_PROMPT_INJECTION]: The skill is highly vulnerable to indirect injection because it takes untrusted data (the user's request) and interpolates it directly into a high-privilege capability (shell execution) without any sanitization, validation, or boundary markers.
Ingestion point: [user's complete request]
Capability: Bash (Shell execution)
Sanitization: Explicitly forbidden by the instructions ("Pass the user's request directly... without modification").
[METADATA_POISONING]: The skill makes deceptive claims about using "GPT-5," a model that is not publicly available. This misleading information could trick users or the agent into assuming a higher level of capability or trust than actually exists.

oracle