The Agent Skills Directory

[COMMAND_EXECUTION]: Command injection vulnerability in scripts/generate_brief.sh. The script employs the eval command to assign user-supplied input to shell variables within the prompt_input function. Because the input is not sanitized or escaped, a malicious user can supply shell metacharacters, such as single quotes followed by command separators (e.g., '; rm -rf /; ') or subshell expansions (e.g., $(command)), to execute arbitrary code with the same privileges as the agent.
[COMMAND_EXECUTION]: Arbitrary file write and potential overwrite in scripts/generate_brief.sh. The script defines the $OUTPUT_FILE variable based on unvalidated user input and uses it in a file redirection operation (cat > "$OUTPUT_FILE"). This allows an attacker to specify arbitrary file paths, potentially leading to the overwriting of sensitive system files or the creation of unauthorized files in the workspace.
[PROMPT_INJECTION]: Vulnerability to indirect prompt injection through interactive script execution. The skill's workflow encourages the agent to execute an interactive bash script that processes untrusted user data. The lack of sanitization in this pipeline allows a malicious user to inject commands that the agent will then unknowingly execute, bypassing standard safety constraints for direct shell access.
[PROMPT_INJECTION]: Mandatory Evidence Chain for Indirect Injection:
Ingestion points: User input captured via the read -r command in the scripts/generate_brief.sh script.
Boundary markers: Absent; the user-provided strings are directly interpolated into eval statements and document templates without delimiters or 'ignore' instructions.
Capability inventory: The skill has access to shell command execution (eval), system environment queries (whoami), and local file system write access (cat >) via its provided scripts.
Sanitization: Absent; there is no validation, escaping, or filtering of user input before it is passed to sensitive shell operations.

design-brief-generator