The Agent Skills Directory

[COMMAND_EXECUTION]: The Ruby helper script (scripts/brakeman_helper.rb) constructs shell commands by joining arrays into strings using space delimiters and then executing them via the system() method. User-supplied parameters, specifically @options[:app_path] and @options[:baseline_file], are interpolated into these strings without any shell escaping or sanitization. This allows for command injection if a directory or file name contains shell metacharacters (e.g., ;, &, |, or backticks), which could lead to arbitrary code execution or data exfiltration.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to analyze third-party Ruby on Rails source code, which acts as an untrusted data ingestion point. Malicious instructions could be embedded in code comments or string literals within the scanned project, intending to influence the AI agent when it processes and summarizes the resulting security reports.
Ingestion points: Rails application source code files and directory paths processed by the scanner and helper script.
Boundary markers: The skill lacks explicit boundary markers or "ignore embedded instructions" warnings for the agent when it handles the output of the scan.
Capability inventory: The skill includes capabilities for shell command execution (system() in the helper script) and file system interactions (via the Brakeman tool).
Sanitization: No sanitization or filtering is performed on the content of the scanned files before the results are presented to the agent.
[EXTERNAL_DOWNLOADS]: The documentation describes installation procedures for the brakeman gem via RubyGems and a Docker image from presidentbeef/brakeman. These are standard sources for the Brakeman tool and do not represent a security risk.

brakeman