The Agent Skills Directory

[COMMAND_EXECUTION]: Vulnerable use of child_process.exec in check-domains.js allows for arbitrary command execution. The script constructs a shell command using string interpolation: whois ${domain}. The domain variable incorporates data generated by the AI agent based on user input without any sanitization or escaping of shell metacharacters. If the AI is manipulated into generating a name containing characters like ;, &, or |, those commands will be executed by the host shell.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection.
Ingestion points: Project descriptions provided by the user are processed in SKILL.md.
Boundary markers: Absent. There are no delimiters or instructions to ignore embedded commands within the user's project description.
Capability inventory: The skill utilizes child_process.exec within check-domains.js to run system commands.
Sanitization: Absent. The script does not validate or sanitize the input strings before passing them to the shell execution function.

project-name-generator