The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs direct shell command interpolation of several variables derived from external or user-provided input without sanitization.
Evidence: In Phase 1, Phase 2, and Phase 4, the variables ${URL}, ${BASE_URL}, and ${PAGE_PATH} are used inside curl commands and shell loops (e.g., curl -sf "${URL}/health").
If these variables contain shell metacharacters like semicolons, backticks, or subshell expansions, they will be executed by the shell environment processing the instructions.
[INDIRECT_PROMPT_INJECTION]: The skill features a significant attack surface where untrusted data from the web influences executable shell blocks.
Ingestion points: In Phase 3, the skill fetches and parses sitemap.xml and robots.txt from the target URL to discover pages to monitor.
Boundary markers: There are no boundary markers or instructions to ignore embedded malicious content in the parsed data.
Capability inventory: The skill utilizes curl, git, mkdir, and general shell execution.
Sanitization: The paths extracted via grep from sitemaps are added to the ${PAGES[@]} array and executed in a loop in Phase 4 without any escaping or validation. A malicious site could serve a sitemap containing a path like "; touch /tmp/pwned; #" to trigger execution.
[DATA_EXPOSURE]: The skill accesses local project metadata and configuration files to identify the deployment environment.
Evidence: It reads fly.toml, render.yaml, vercel.json, netlify.toml, Procfile, and railway.toml to detect the platform.
Evidence: It executes git log and git branch to capture deployment context. These operations are consistent with the skill's stated purpose of post-deploy monitoring.

canary