The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands to execute local Python scripts with arguments derived directly from user input and external data.
Evidence: The command python3 scripts/competitor_research.py analyze "<app>" in SKILL.md uses a name or ID provided by the user. If the user provides an input like "; rm -rf /; ", it could lead to arbitrary code execution.
Evidence: The command python3 scripts/competitor_research.py rank ... --tokens "..." uses tokens generated by the AI after analyzing untrusted App Store metadata. If a competitor app contains shell metacharacters in its metadata, it could trigger command injection when the AI extracts it as a token.
Mitigation: Sanitize all inputs before passing them to the shell, or use the subprocess module with argument lists instead of shell strings to avoid shell interpolation.
[PROMPT_INJECTION]: The skill processes untrusted App Store metadata which creates a surface for indirect prompt injection.
Ingestion points: SKILL.md Stage 2 and Stage 3 (processing data/phase_a_competitors_<slug>.json and data/phase_b_competitors_<slug>.json which contain external app titles, keywords, and descriptions).
Boundary markers: Absent. No delimiters or instructions are provided to the agent to treat external strings as untrusted data.
Capability inventory: The agent has the ability to execute shell commands (scripts/competitor_research.py) and generate report files.
Sanitization: Absent. The skill uses the metadata directly for tokenization and relevance filtering.
Risk: A malicious app developer could craft metadata designed to trick the AI into misclassifying competitors or performing unintended actions.
Mitigation: Wrap external content in clear boundary markers (e.g. XML tags or triple backticks) and instruct the agent to ignore any embedded commands within the metadata.

competitor-research