The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection in the script.sh file. It takes a user-supplied AI system description as a command-line argument and interpolates it directly into an LLM prompt template without sanitization or protection.
Ingestion points: The script uses the first command-line argument ($1) as the raw system description for analysis.
Boundary markers: Absent. There are no delimiters (such as ### or <input>) or instructions to ignore embedded commands within the user's description, allowing a malicious input to potentially override the classification instructions.
Capability inventory: The script uses the gemini CLI tool for inference and outputs results to the terminal.
Sanitization: Absent. The raw input is placed directly into the prompt string, enabling an attacker to manipulate the classification outcome (e.g., forcing a 'LOW-RISK' result for a 'HIGH-RISK' system).
[COMMAND_EXECUTION]: The shell script script.sh uses brittle and non-standard quoting patterns (PROMPT=\"...\") to construct the command for the gemini CLI tool. While not a direct remote code execution vulnerability, this pattern may lead to unexpected shell behavior or incorrect argument parsing if the user input contains specific shell metacharacters or nested quotes.
[DATA_EXFILTRATION]: The skill processes potentially sensitive data—proprietary AI system descriptions which may include trade secrets—and transmits it to an external LLM service (gemini) for processing. Although this is the intended function, the documentation in SAFETY.md and SKILL.md acknowledges the high sensitivity of this data, making its transmission to a third-party service a significant exposure risk.
[PROMPT_INJECTION]: There is a metadata discrepancy between the documentation and the implementation. The SKILL.md claims the dependency is oracle, whereas the script.sh uses the gemini CLI tool. Additionally, the branding of the skill as 'hardened' and 'armored' in SKILL.md and SAFETY.md is primarily based on prompt-level instructions rather than technical implementation safeguards.

ai-act-risk-check-hardened